The CyberPHIx: Meditology Services Podcast: Recent Episodes
Brian Selfridge: Healthcare IT Thought Leader
The CyberPHIx is a regular audio podcast series that reports and presents expert viewpoints on data security strategy for organizations handling patient health or personal information in the delivery of health-related services. These timely programs cover trends and data security management issues such as cybersecurity risk management, HIPAA and OCR compliance strategy and vendor risk management. Meditology Services, the healthcare industry's leading security and compliance firm, moderates the discussions with leaders in healthcare data security.
Join us for this episode of The CyberPHIx podcast, where we hear from Morgan Hague.
Morgan is the manager of IT Risk Management at Meditology Services and has been in the industry for nearly a decade. He has worked with hundreds of organizations in an advisory capacity helping to assess or audit security functions to drive program maturity. He also leads Meditology’s strategic risk management consulting service line and is a subject matter expert in threat mitigation and risk program development.
Topics covered in this session include:
- A deep dive into the emerging use cases for AI in the healthcare setting
- The risks related to AI that defenders need to be aware of and how real and relevant those risks are in the current state
- Data Poisoning, Input Manipulation, Membership Reference & Model Inversion
- AI-driven attacks and human security risks
- Privacy concerns with the use of AI
- New regulations coming online that directly affect the use of AI
- Controls we should be considering for AI
- Frameworks that already exist to help us understand the control options
- And some practical tips on where to get started
The CyberPHIx Roundup is your quick source for keeping up with the latest cybersecurity news, trends, and industry-leading practices, specifically for the healthcare industry.
In this episode, our host Britton Burton highlights the following topics trending in healthcare cybersecurity this month:
- The Changes to HHS 405(d) HICP publication on the top 5 threats and top 10 security practices for healthcare
- The NIST Cyber Security Framework 2.0 Discussion Draft
-
The riskiest connected medical devices and IoT (including nurse call, infusion pumps, and IP cameras)
-
Some free security awareness resources for clinicians from Health Sector Coordinating
- Moody’s report on healthcare lagging behind other industries in implementing cybersecurity practices
- OCR regulatory focus on pixel tracking technologies on HIPAA-Covered-Entity websites
- Some fascinating numbers on the increase in lawsuits after breaches and ransomware payment averages
-
A new ally for security leaders in the Chief Supply Chain Officer (CSCO)
-
And Apple’s new Rapid Security Response updates for iOS, iPadOS, and macOS
Join us for this episode of The CyberPHIx podcast where we hear from Ryan Patrick, Vice President of Adoption at HITRUST.
Ryan works with clients to understand and implement the HITRUST-validated assessments that best suit their organization’s risk profile. Prior to this role, he spent many years as a security practitioner and IT lead in a wide range of organizations from the US Army to Covered Entities to healthcare cybersecurity consulting firms. He has a wealth of practical security experience that informs every discussion about security or HITRUST.
Topics covered in this session include:
- The new HITRUST v11 and what it means for organizations who are considering the HITRUST journey
- HITRUST’s traversable levels of assurance from e1 to i1 to r2
- A newly created threat adaptive control selection process they use
- How broken and unsustainable TPRM (Third Party Risk Management) is today
- How HITRUST services fit into the third-party risk landscape
- A discussion about the new Health Third Party Trust (H3PT) council and what that group is trying to do to solve TPRM
- An invitation to meet either of us in person at HIMSS in Chicago April 17 – 21
- And a cool update on HITRUST’s Results Distribution System (RDS) and the automation opportunities it will provide
The CyberPHIx Roundup is your quick source for keeping up with the latest cybersecurity news, trends, and industry-leading practices, specifically for the healthcare industry.
Our host Britton Burton spends this entire episode reviewing and analyzing the recently released National Cybersecurity Strategy, including:
- Summarizing, and in some cases quoting, the key points from the document that are most relevant to healthcare security pros who may have time to listen but not read
- Analyzing how those key points will affect the healthcare industry in the coming months and years
-
Explaining how (and when) the rulemaking process might play out
-
The impact this could have on cloud and third-party risk
- Implications of incident reporting and the positive side of the emphasis on it
- An interesting wrinkle in the cyber insurance space
- Increased scrutiny on IoT manufacturers
-
How the technology and software industry is similar to the automotive industry 50 years ago
-
And much more!
The CyberPHIx Roundup is your quick source for keeping up with the latest cybersecurity news, trends, and industry-leading practices, specifically for the healthcare industry.
In this episode, our host Britton Burton highlights the following topics trending in healthcare cybersecurity this month:
- The Federal Trade Commission’s (FTC) first Health Breach Notification Rule Enforcement action against GoodRx
- An unsurprising report from OCR on security rule compliance areas that HIPAA-regulated entities need improvement plus the most common remediation actions taken by breached entities
- Semi-definitive information about the date and final rule content of the SEC’s looming rule for publicly traded companies on Cybersecurity disclosures and risk management
- NIST’s announcement on a new lightweight cryptography algorithm that can be used by IoT and Medical Devices
- The disheartening cyber attack on the 988 suicide and mental health helpline
- Interesting new trend data on the lower volume of healthcare breaches but higher count of individuals affected by those breaches
- A recent surge in Wiper malware attacks, thanks in large part to the Russia/Ukraine war
- A fascinating narrative on cyber insurance involving exclusion of nation-state attack vectors from policies, sharper focus on TPRM programs, and a ransomware gang’s unusual request to its victims
The CyberPHIx Roundup is your quick source for keeping up with the latest cybersecurity news, trends, and industry-leading practices, specifically for the healthcare industry.
In this episode, our host Britton Burton highlights the following topics trending in healthcare cybersecurity this month:
- The Federal Trade Commission’s (FTC) first Health Breach Notification Rule Enforcement action against GoodRx
- An unsurprising report from OCR on security rule compliance areas that HIPAA-regulated entities need improvement plus the most common remediation actions taken by breached entities
- Semi-definitive information about the date and final rule content of the SEC’s looming rule for publicly traded companies on Cybersecurity disclosures and risk management
- NIST’s announcement on a new lightweight cryptography algorithm that can be used by IoT and Medical Devices
- The disheartening cyber attack on the 988 suicide and mental health helpline
- Interesting new trend data on the lower volume of healthcare breaches but higher count of individuals affected by those breaches
- A recent surge in Wiper malware attacks, thanks in large part to the Russia/Ukraine war
- A fascinating narrative on cyber insurance involving exclusion of nation-state attack vectors from policies, sharper focus on TPRM programs, and a ransomware gang’s unusual request to its victims
The CyberPHIx Roundup is your quick source for keeping up with the latest cybersecurity news, trends, and industry-leading practices, specifically for the healthcare industry.
In this episode, our host Britton Burton highlights the following topics trending in healthcare cybersecurity this month:
- A new National Cybersecurity Strategy coming from the Biden administration in the next few weeks
- Healthcare cybersecurity legislation with mandatory requirements coming from Senator Mark Warner by the end of 1Q
- More ChatGPT analysis on malware writing and that it is NOT suitable for use in a HIPAA Privacy compliant manner
- A small hospital in Illinois closes due to COVID expenses and a cyber attack that shut down billing
- The new Rural Emergency Hospital rule for struggling critical access and rural facilities
- The impact of travel nursing on cybersecurity
- FBI and Hive ransomware + why FBI wants more victims to call them
- Microsoft OneDrive takes first place for cloud app malware distribution
- A new DDoS threat from KillNet against healthcare and what to do about it
- An interesting update from the Russian/Ukraine war
- A call for community help on the evolution of NIST CSF and CSA CCM
The CyberPHIx Roundup is your quick source for keeping up with the latest cybersecurity news, trends, and industry-leading practices, specifically for the healthcare industry.
In this episode, our host Britton Burton highlights the following topics trending in healthcare cybersecurity this month:
- New FDA authority granted by December’s omnibus bill is a big step towards better medical device security
- HITRUST teases their new CSF v11 release
- CommonSpirit Health class action lawsuit
- The fallout from the LastPass follow-on breach
- The possibly similar situation that might be occurring at Okta
- JAMA Health Forum’s outstanding metrics study on ransomware attacks in healthcare from 2016 – 2021
- The nefarious use cases of OpenAI’s ChatGPT
- Clop ransomware group’s tactics for taking advantage of Telehealth appointments to deploy malware
- An apology from LockBit ransomware group for an attack on a children’s hospital (really!)
- Healthcare CISOs collaborating thru Healthe3PT to solve the third-party risk problem
- A major precedent-setting breach settlement order from FTC against Drizly and its CEO
The CyberPHIx is your source for keeping up with the latest cybersecurity news, trends and industry leading practices, specifically for the healthcare industry.
In this episode, our host Britton Burton highlights some bold, and some not so bold, predictions for healthcare cybersecurity in 2023. Topics covered include:
- Continued escalation and evolution of ransomware attacks
- Our growing dependency on cloud platforms and vendor solutions shifting the attacker’s focus and changing breach trends
- New baseline expectations for critical infrastructure cybersecurity that could lead to increased federal or state level rule making
- Remote work and Zero Trust
- Medical devices, IoT, OT, & IoMT (oh my!)
- The rise of the class action lawsuit
- The continued expansion and cool solution ideas for 3rd and 4th party risk
- The importance of security assurances and validated assessments / certifications
- The curios case of cyber liability insurance
- A new emphasis from the board on cyber resilience and TPRM
The CyberPHIx Roundup is your quick source for keeping up with the latest cybersecurity news, trends, and industry leading practices, specifically for the healthcare industry.
In this episode, our host Britton Burton highlights the following topics trending in healthcare cybersecurity this week:
- OCR releases more detail on their Recognized Security Practices (RSPs) and what they mean for Covered Entities
- A cool new tool from the FTC for mobile health app developers to quickly determine which security and privacy regulations are in scope for their app
- Trends in the consumerization of healthcare with some interesting technology announcements from Amazon and Epic
- The next step in the Meta Pixel story, including some interesting guidance from OCR in how Covered Entities need to handle these tracking technologies
- A new Medical Device Security Playbook from a MITRE and FDA collaboration
- A Moody’s report on how inflation is hindering health systems' ability to bolster cybersecurity
- An interesting impact you may not have expected in the CommonSpirit ransomware story
- A landmark decision in the realm of cybersecurity insurance in the T-Mobile / Zurich American Insurance case
- A report from Senator Mark Warner that gives us a glimpse into some regulatory activity we might see in 2023
Change is on the horizon for The CyberPHIx! Join us as your new host, Britton Burton, interviews your favorite host, Brian Selfridge to discuss it.
This episode is a little different flavor than normal as your beloved host takes some time to explain what’s next for him and to reflect on some really interesting experiences he’s enjoyed in his cybersecurity career.
Topics covered in this session include:
- The transition of the podcast hosting duties from Brian to Britton
- What it actually means to be an OCR HIPAA expert witness
- What interesting trends Brian has seen and knowledge he’s gained serving in that role
- Awesome advice and lessons he’s learned from a multi-faceted cybersecurity career journey
Healthcare cybersecurity has seen major game-changing risk management models and companies emerge in the last several decades. These include the introduction of the HITRUST Common Security Framework (CSF) and certification model and the emergence of companies like Meditology Services and CORL Technologies that are dedicated to solving big, complex challenges facing the healthcare industry.
At the center of these innovative models and new paradigms is one leader in particular: Cliff Baker. Cliff has a long list of accomplishments envisioning and delivering game-changing solutions for healthcare cybersecurity. He began his notable career with PricewaterhouseCoopers (PwC), where he led the organization’s national healthcare security practice. Cliff later went on to architect the HITRUST CSF and certification model and founded two industry-leading cybersecurity companies, Meditology Services and CORL Technologies.
Join us for this episode of the CyberPHIx podcast where we hear from Cliff Baker, CEO for Meditology Services and CORL Technologies.
Topics covered in this session include:
* Leading practices and new models for measuring and reporting cyber risks
- How to measure the effectiveness of healthcare cybersecurity programs
- Insights into the inception of the HITRUST certification model and the HITRUST CSF
- The current state of HITRUST adoption and use cases for the industry
- Perspectives on the role that HITRUST will play in the next decade for healthcare cybersecurity and third-party vendor risk management (TPRM)
- The process for envisioning, designing, and implementing game-changing cybersecurity models and companies
- Solutions and innovations that Cliff is cooking up in the lab to solve the next wave of large, complex challenges facing healthcare cybersecurity
- How leaders can move from idea to reality for delivering game-changing solutions and companies
The CyberPHIx Roundup is your quick source for keeping up with the latest cybersecurity news, trends, and industry leading practices, specifically for the healthcare industry.
In this episode, our host Brian Selfridgehighlights the following topics trending in healthcare cybersecurity this week:
* Deep dive into new CISA Cybersecurity Performance Goals (CPGs) for healthcare and critical infrastructure
- NSA releases new “hacker’s playbook” for operational technology (OT) cyberattacks
- American Hospital Association (AHA) endorses the Healthcare Cybersecurity Act draft bill
- Gramm-Leach-Bliley Act (GLBA) amendments become effective this December that may bring healthcare into scope for GLBA security requirements and enforcement
- Massive ransomware outage for CommonSpirit Health impacting over 142 hospitals and the Epic MyChart EHR platform
- Advances in quantum computing for encryption and the potential for “Q-day” events that could expose all encrypted data to unauthorized decryption
- HHS warns of abuse of common security and system administration tools that are being abused by attackers
- CISA alert about Daixin Team ransomware gang targeting healthcare PACS environments via VPN and RDP attacks
- New stats and guidance on public cloud security trends and recommendations
The last few years third-party vendor risk management (TPRM) has transitioned from being a relatively minor part of security and compliance programs for healthcare entities into a massive undertaking with potentially dire consequences if not managed properly. This is one of those topics that seems to really have CISOs shaking in their boots.
What makes third party vendor risk so scary? Why are security leaders having nightmares?
Join us for this episode of the CyberPHIx podcast where we hear from James Ballou, Chief Information Security Officer for North American Partners of Anesthesia.
James shares insights from his extensive experience managing security teams and third-party risk management programs for leading healthcare organizations.
Topics covered in this session include:
- What makes third-party vendor risk management so scary for healthcare cybersecurity and risk professionals?
- Regulatory requirements related to third-party vendor risk management including HIPAA and state laws
- OCR enforcement of third-party business associate compliance mandates
- Third-party vendor risk governance best practices and models
- The implications for vendors that acquire certifications including HITRUST, SOC 2, and ISO
- The limitations of questionnaire-based vendor assessment models
- Best practices for strategic and operational management of third-party vendor risk management programs in healthcare
- The future of third-party vendor risk management
The CyberPHIx Roundup is your quick source for keeping up with the latest cybersecurity news, trends, and industry-leading practices, specifically for the healthcare industry.
In this episode, our host Brian Selfridgehighlights the following topics trending in healthcare cybersecurity this week:
- New Ponemon study that links increased mortality rates and poorer patient outcomes following cyber attacks
- Massive third-party breach cripples Britain’s National Health Service (NHS) via ransomware breach that takes down 111 services (akin to 911 services in the US)
- FBI warning and increased reporting of financial processing attacks against healthcare providers via phishing and social engineering
- Ambry Genetics settles class action lawsuit for $12.5m following 2020 breach of over 230,000 patient records
- OCR announces $300k settlement related to improper disposal of specimen containers with PHI on labels
- New FBI report on medical device security vulnerabilities and recommendations for healthcare organizations
- Updates on cyberwarfare trends stemming from the Russia/Ukraine conflict; Ukraine issues warning to allies of potential new cyberattacks from Russia
- President Biden signs new cybersecurity guidelines following CISA recommendations
- New federal cybersecurity requirements from the Office of Management and Budget (OMB) and NIST accreditation for third-party vendor risk management
- Healthcare sector leads all industries in fixing software security flaws; report highlights and analysis
Engaging IT and other technical stakeholders to support cybersecurity initiatives can be a daunting task for security professionals. We are often the bearers of bad news or can be perceived as adding to the workloads of already overburdened IT teams. In short, it can be hard to make friends.
Join us for this episode of the CyberPHIx podcast where we hear from David Jones, Director of Information Security for RxBenefits, Inc.
David has held leadership roles in security, infrastructure, engineering, and networking for a variety of organizations inside and outside of healthcare. He has lived through security program implementations and learned how to work across IT functional groups to break down barriers and achieve mutual objectives.
David provides practical insights and guidance for making friends with various IT groups and teams to reduce cybersecurity risks while advancing IT objectives.
Topics covered in this session include:
- Explanation of the different technical stakeholder groups that security most commonly needs to engage in support of the delivery of security programs
- How to prevent and resolve tension between security teams and server admins, network engineers, help desk, development teams, and more
- Best practices for engaging server admins and engineers through common security functions such as patching and configuration management
- Network administrator touchpoints with security and ways to communicate effectively
- Strategies for embedding security resources with infrastructure teams and vice versa to improve collaboration
- Leading practices for engaging software development, DevOps, and helpdesk teams
- How to manage audit fatigue and coordinate efficient audits with IT groups
- Industry resources including conferences and training sources for emerging security and IT personnel
The CyberPHIx Roundup is your quick source for keeping up with the latest cybersecurity news, trends, and industry-leading practices, specifically for the healthcare industry.
In this episode, our host Brian Selfridgehighlights the following topics trending in healthcare cybersecurity this week:
- Historic breach levels reached for healthcare between 2020-2022; trends and analysis
- Attackers shifting focus to target small hospitals, clinics, and vendors
- Cisco breach and related impacts on healthcare organization networks
- Stats from SecureLink’s new report on third-party data breaches and analysis of healthcare-specific takeaways
- LastPass source code breach and potential exposures to individuals and centrally-managed healthcare organization passwords
- Cyberliability trends and criteria required to obtain and maintain coverage
- NIST CSF 2.0 workshop highlights and industry feedback
- TEFCA selects HITRUST’s r2 certification for Qualified Health Information Network organizations to prove compliance with security practices
- Health ISAC (H-ISAC) guidance on zero trust implementation for healthcare entities
- Guidance from federal agencies on emerging cloud security threats and recommended practices
- FBI warns of new sophisticated scam targeting the healthcare workforce
- New federal advisory related to attacks from “Evil Corp” on the healthcare industry
Breaches continue to balloon for healthcare applications as the industry continues to drive innovations in virtual care, personalized medicine, and digital healthcare. Organizations that deploy robust application development security programs create the opportunity to identify and correct security weaknesses before products hit the market.
Software Development Lifecycle (SDLC) security programs provide the tools, processes, and training required to design products with security in mind to reduce the likelihood of breaches of sensitive information.
Join us for this episode of the CyberPHIx podcast where we hear from Ed Adams, CEO for Security Innovation. Security Innovation provides application security services, training, testing, and consulting to healthcare and other industries.
Topics covered in this session include:
* Application development security trends
- The latest threats and vulnerabilities impacting healthcare application development
- Best practices for securing AppDev, DevOps, and DevSecOps teams and processes
- Common development misconceptions and missteps that lead to security exposures
- Security training approaches for healthcare app developers
- Frameworks and external resources for SDLC security including OWASP and others
- Healthcare-specific vulnerabilities and risk exposures identified during application development
- Third-party and fourth-party risks including open-sourced code and IoT devices
- Budget priorities for SDLC security investments
The CyberPHIx Roundup is your quick source for keeping up with the latest cybersecurity news, trends, and industry-leading practices, specifically for the healthcare industry.
In this episode, our host Brian Selfridgehighlights the following topics trending in healthcare cybersecurity this week:
- IBM’s and Ponemon’s annual Cost of a Data Breach Report summary, analysis, and implications for healthcare
- Updated NIST guidance on HIPAA compliance approaches and expected practices
- Facebook (Meta) and healthcare providers targeted with multiple lawsuits over health data privacy practices
- GAO report warns of catastrophic financial loss due to cyber insurers backing out of covering damages from cyberattacks
- $100m cost reported for Tenet Healthcare’s 2022 cyberattack
- Major breaches with healthcare vendors OneTouchPoint and Avamere impacting more than 1.5m people
- Cloud Security Alliance weighs in on third-party risk management in healthcare
- Large-scale cyberattack campaign targeting over 10,000 organizations in phishing and financial fraud scheme
- HHS Health Sector Cybersecurity Coordination Center alert about an increase in web application attacks on the healthcare sector
- New ransomware task force report targeting government interventions to disrupt ransomware attacks
- OCR issues 11 new financial penalties over HIPAA Right of Access failures
Healthcare organizations are ramping up the adoption of enterprise security certifications to provide assurance of their security program and control effectiveness to their customers and partners. Some of the most common security certifications and attestations in healthcare include HITRUST and SOC 2 Type II.
Join us for our 100TH EPISODE of The CyberPHIx as we hear perspectives from healthcare security leaders on best practices for selecting and acquiring enterprise security certifications.
This special symposium is a collection of interviews with stakeholders on all sides of the certification including healthcare CISOs, assessor and certification specialists, healthcare vendors, healthcare delivery organizations, and certification bodies.
The Certification Symposium includes highlights from the following healthcare cybersecurity leaders:
* **Michael Parisi** - Vice President of Adoption, HITRUST
- Ed Dame - CISO, Dasher Services
- Angela Fitzpatrick - Managing Director, Meditology Services
- Paul Gray - CISO, Meditology Services
- Bethany Ishii - Director, Meditology Services
- Deana Fuller - Senior Manager, Meditology Services
- Ryan Freeman-Jones - Leader, Meditology Services
- Brandon Weidemann - Manager, Meditology Services
- Jonathan Elmer - Manager, Meditology Services
-
Derek Vorpahl - Director of Information Security and Risk Management, Davis Vision
Topics covered in this session include:
-
What are HITRUST and SOC 2 Type II certifications?
- Business drivers for healthcare organizations to acquire HITRUST & SOC 2 certifications
- Which certification should we adopt? Comparing and contrasting certification options including HITRUST bC, HITRUST i1, HITRUST r2, SOC 2 Type II, and ISO
- Common pitfalls for HITRUST certifications
- Common challenges and pitfalls for SOC 2 Type II examinations
- Debunking certification myths and misunderstandings
- Accelerators and best practices for achieving HITRUST and SOC 2 certifications in a timely and cost-effective manner
- The role that certifications play in supporting HIPAA and OCR compliance
- Tips for selecting an assessor organization for HITRUST and SOC 2 certifications
The CyberPHIx Roundup is your quick source for keeping up with the latest cybersecurity news, trends, and industry-leading practices, specifically for the healthcare industry.
In this episode, our host Brian Selfridgehighlights the following topics trending in healthcare cybersecurity this week:
- Bombshell report of hospitals sharing PHI with Facebook
- HIPAA compliance analysis for covered entities sending PHI to Facebook
- Legal exposures for sending sensitive information to social media and other website tracking vendors
- Recommendations for healthcare organizations to assess and respond to patient concerns about unauthorized PHI disclosures to Facebook
- HHS issues new guidance for healthcare organizations to improve their cyber posture
- New HIPAA Security Risk Analysis (SRA) tool from OCR
- New OCR guidance and industry feedback related to “recognized security practices” for healthcare organizations (i.e. safe harbors for OCR enforcement)
- HHS issues warning to healthcare entities about dangerous Emotet malware proliferation
- CISA is developing new guidance for helping organizations overcome supply chain risks
- FBI prevents “despicable” Iranian cyber attack on Boston Children’s Hospital
- DOJ shuts down SSNDOB dark web marketplace
- Massive arrests and seizures of social engineering attack infrastructure across 76 countries
- OCR issues guidance on the upcoming expiration of COVID-19 enforcement exemptions for telehealth HIPAA security mandates
Join us for this episode of The CyberPHIx podcast where we hear from Bart Layton, VP of Product for CORL Technologies, who was also a leader on the team that overhauled and secured healthcare.gov.
In this two-part conversation, we discuss Bart’s insights into the deployment and security of healthcare.gov as well as his perspectives on third- and fourth-party cyber risks for healthcare organizations.
About Healthcare.gov
Healthcare.gov is the nation's federal exchange for health insurance coverage that was created from the passing of the Patient Protection and Affordable Care Act (ACA). The initial launch of the website was fraught with challenges and was ultimately "rescued" by a large team contracted to get the site operating in tip-top shape.
About Fourth-Party Vendor Risks
Cybercriminals and nation-states have also unleashed relentless cyber-attacks on the U.S. healthcare industry and its suppliers this year. Unfortunately, cyber risk exposures have not been limited to third-party vendors, and risks to sensitive data and systems often extend across the full supply chain including fourth-party vendors and open-sourced products.
Topics covered in this session include:
* What is healthcare.gov?
- How and why was healthcare.gov overhauled in the early stages of its development?
- Security challenges and solutions for healthcare.gov that arose during implementation
- Cloud security considerations for hosted healthcare applications including healthcare.gov
- What is fourth-party vendor risk and how is it impacting healthcare organizations?
- Examples and case studies of prominent fourth-party vendor breaches in healthcare
- Emerging solutions and innovations in third- and fourth-party vendor risk management
- New federal regulations and standards for managing supply chain risks
The CyberPHIx Roundup is your quick source for keeping up with the latest cybersecurity news, trends, and industry-leading practices, specifically for the healthcare industry.
In this episode, our host Brian Selfridgehighlights the following topics trending in healthcare cybersecurity this week:
* Highlights from the US Senate HELP hearing discussing the threat of cyberattacks on the healthcare industry
- Healthcare and Public Health Sector Coordinating Council (HSCC) releases new incident response checklist
- Ransomware growth causes cyber liability insurance costs to skyrocket
- Cardiologist charged with designing and selling ransomware
- BakerHostetler data security incident response report highlights and analysis
- Vendor risk management trends and associated healthcare breaches
- Solara Medical Supplies proposes a $5 million settlement to resolve class action data breach lawsuit
- CISA Alert: Weak Security Controls and Practices Routinely Exploited for Initial Access
- CISA alerts organizations not to install May security patches on Microsoft domain controllers
- US Department of Health and Human Services (HHS) warning healthcare entities about the aggressive Hive ransomware group
- A look back on the Conti ransomware group’s attacks on 200+ healthcare entities over the last two years
- HHS information on Russian Advanced Persistent Threat (APT) groups and associated analysis
Major shifts in the delivery of healthcare are introducing new and unforeseen cybersecurity and privacy risks. Cybersecurity and risk leaders in healthcare must rapidly adapt their programs and protection mechanisms to avoid adverse impacts from evolving cyber threats.
Any one of these emerging risk areas can cut deep and have material impacts to patient safety, financials, reputation, and more. In this session, we provide an overview of new cyber threats and solutions through the lens of **Ron Belfont**, *Information Security Officer and Director of Security & Support Services* for Bayhealth Medical Center, and his years of experience safeguarding patient information and systems.
Topics covered in this session include:
- Internet of Things (IoT) & Internet of Medical Things (IoMT) challenges and solutions
- Securing health apps and wearables
- Emerging regulatory changings including HIPAA
- Cybersecurity approaches for the remote workforce
- Fourth-party vendor risks and securing the healthcare supply chain
- Cyberwar and changes to the threat landscape
The CyberPHIx Roundup is your quick source for keeping up with the latest cybersecurity news, trends, and industry-leading practices, specifically for the healthcare industry.
In this episode, our host Brian Selfridgehighlights the following topics trending in healthcare cybersecurity this week:
- Healthcare Cybersecurity Act introduced in the U.S. Senate; details and analysis about the proposed regulation
- HHS and OCR seek feedback on new HITECH safe harbors for the adoption of cybersecurity best practices including NIST and HITRUST
- OCR requests feedback on how HIPAA civil monetary penalties should be shared with individuals that have been victims of breaches
- University of Pittsburgh Medical Center is required to make payments to 66,000 employees that were victims of a 2014 cyber breach as part of legal settlement
- Proposed PATCH Act that would see the FDA require cybersecurity measures for medical device manufacturers; details and analysis
- New NIST standards for enterprise patching management including NIST SP 800-40 and NIST SP 1800-31
- FDA releases updated guidance on medical device cybersecurity (in addition to the PATCH Act)
- Lapsus$ cyber threat group alerts from the Health Sector Cybersecurity Coordination Center (HC3) as well as prominent arrests of the Lapsus$ gang’s teenage leader
- Arrest of ransomware leader responsible for 13 ransomware attacks; details of attacks and sentencing
- Germany and the U.S. shut down the world’s largest illegal darknet marketplace
- CISA warns of Uninterruptible Power Supply (UPS) device cyberattacks
- Urgent security alert for Philips MRI monitoring software
- A new zero-day vulnerability in the Spring Core Java framework called 'Spring4Shell'
- S State Department announces Bureau of Cyberspace and Digital Policy (CDP)
President Biden issued an alert recently that U.S. companies must ramp up their readiness to anticipate potential cyberattacks from Russia stemming from the conflict in Ukraine.
What role do end-users play in protecting healthcare organizations during this ongoing cyberwar? Is the workforce our best defense on the front lines of cyber combat?
Join us for this episode of the CyberPHIx podcast where we hear from Eric Bielski, Director of Information Security for Benefit Resource.
Eric provides insights into leading practices for cybersecurity awareness programs for healthcare entities.
Topics covered in this session include:
- How to make cybersecurity important for the average workforce member
- Effective deployment vehicles for awareness training
- Maintaining cybersecurity awareness for hybrid and remote workforce
- Free resources for security awareness and HIPAA compliance content
- Top messages for the workforce to combat cyberwar attacks
- Measuring effectiveness of awareness programs via KPIs
- Phishing testing and training best practices
The CyberPHIx Roundup is your quick source for keeping up with the latest cybersecurity news, trends, and industry-leading practices, specifically for the healthcare industry.
In this episode, our host Brian Selfridgehighlights the following topics trending in healthcare cybersecurity this week:
- President Biden’s cybersecurity warning about Russian cyberattacks on U.S. companies
- New cybersecurity legislation signed that mandates breach reporting within 72 hours
- SEC proposes new cybersecurity disclosure requirements
- New FBI & CISA alert on Russian exploitation of multi-factor authentication and “PrintNightmare” vulnerability
- Hactivists attacks on Russia databases, TV broadcasts, weapons manufacturers, websites, and the Russian Roskomnadzor censorship agency
- Russia’s creation of their own TLS Certificate Authority (CA) and implications for Internet accessibility in Russia
- FBI alert and guidance on the new RagnarLocker ransomware and implications for healthcare entities
- Details of the new Israel/US collaboration on cybersecurity
- Analysis of the Access:7 vulnerabilities affecting medical devices and IoT systems
- OCR / HHS publication and recommendations for healthcare organizations to improve cybersecurity defenses
- Analysis of the new HIMSS Healthcare Cybersecurity Survey
- New attacks emerge against Microsoft Teams
Who can be trusted to protect sensitive healthcare information and systems amidst a daily barrage of breach events?
Healthcare cybersecurity and risk leaders must identify innovative ways to establish and maintain trust in the healthcare ecosystem through cybersecurity programs and functions. This includes being transparent about risk exposures, building relationships internally and externally, responding effectively to breaches, and adopting certification models like HITRUST and SOC 2.
In this episode of The CyberPHIx, we hear from Ed Dame, Chief Information Security Officer for Dasher Services, Inc.
Ed provides insights and wisdom from his years of experience as a CISO in building relationships and establishing trust. Questions covered in this session include:
- Why is trust important in healthcare settings?
- How can cybersecurity programs support and sustain trust?
- What role does transparency play in building or eroding trust?
- What are the boundaries of accountability for trust for healthcare CISOs including third- and fourth-party vendors?
- What role do cybersecurity certifications like HITRUST play in establishing trust with the market?
- What happens when trust is lost or damaged?
- Is there a right and wrong way to respond to breaches that impacts trust?
- What is the different between reacting and responding to cybersecurity incidents?
- What is the role of emerging “zero trust” models and terminology in healthcare?
The CyberPHIx Roundup is your quick source for keeping up with the latest cybersecurity news, trends, and industry-leading practices, specifically for the healthcare industry.
Healthcare organizations are scrambling to adjust their cybersecurity preparation and response capabilities in the wake of potential cyber-attacks stemming from the ongoing conflict between Russia and Ukraine.
Meditology has been monitoring the situation closely and advising our healthcare clients on the latest threat vectors and response approaches.
This special edition of the CyberPHIx podcast provides guidance for US-based healthcare entities for preparing and responding to cyberattacks and cyberwar tactics deployed as part of this ongoing conflict. We also cover a few other news items trending in healthcare cybersecurity and compliance.
In this episode, our host Brian Selfridgehighlights the following topics:
- Russia-Ukraine cyberwar overview
- Russia’s cyberwar capabilities & attack methods
- Analysis of darknet cyberwar activity
- Guidance from the CISA, FBI, & NSA on the Russia/Ukraine cyberattacks
- Recommendations for healthcare cybersecurity leaders to prepare and respond to cyberwar activities
- Upcoming deadline for HIPAA breach reporting to HHS
- Details on a new bill introduced to modernize HIPAA
- Analysis of the HHS report on securing Electronic Health Records (EHR)
The CyberPHIx Roundup is your quick source for keeping up with the latest cybersecurity news, trends, and industry-leading practices, specifically for the healthcare industry.
In this episode, our host Brian Selfridgehighlights the following topics trending in healthcare cybersecurity this week:
- Lessons learned from a ransomware attack that encrypted 80% of systems across a 54+ hospital health system
- HHS publishes a detailed report about ongoing Log4J exposure and recommendations for the healthcare industry
- REvil ransomware gang shut down and arrested in Russia following US diplomatic pressure and Russian crackdown
- Settlement reached in Excellus class action data breach lawsuit
- Kaspersky publishes report on telehealth adoption and cyber risks escalation
- Homeland Security launches cyber safety review board to combat supply chain risks
- NIST releases automation-friendly security and privacy assessment procedures
- NIST launches new international privacy resources website
Cyberattacks against healthcare organizations and their business associate vendors have begun to threaten patient safety and fundamental business operations. As a result, SOC 2 audit reports have become one of the most common and cost-effective vehicles for healthcare organizations to demonstrate the adoption of controls relevant to security, availability, confidentiality, processing integrity, and privacy.
However, acquiring a SOC 2 audit report can be a challenge for many organizations and there are often questions that arise about how to achieve SOC 2 compliance with the least amount of cost, effort, and time.
Join us for this episode of The CyberPHIx where we hear from Paul Gray, Chief Information Security Officer for Meditology Services.
Paul provides insights from his decades of experience with SOC 2 best practices including answering some frequently asked questions including:
- What is SOC 2 compliance?
- What are the different types of SOC audits including SOC 1, SOC 2, and SOC 3?
- Why do healthcare organizations obtain SOC 2 audit reports?
- Are healthcare vendors required to obtain SOC 2 reports?
- What are the AICPA Trust Criteria?
- What other certifications are available for healthcare organizations?
- What should healthcare organizations do to prepare for a SOC 2 audit?
- What are critical success factors for a successful SOC 2 engagement?
- What are some common pitfalls for healthcare organizations seeking to obtain a SOC 2 audit report?
The CyberPHIx Roundup is your quick source for keeping up with the latest cybersecurity news, trends, and industry-leading practices, specifically for the healthcare industry.
In this episode, our host Brian Selfridge highlights the following topics trending in healthcare cybersecurity this week:
- Microsoft issues updates on the critical Apache Log4j vulnerability and active exploits
- HR and payroll giant Kronos experiences weeks-long ransomware outage
- EHR vendor QRS has been sued for insufficient cybersecurity protections in the wake of a major breach
- Healthcare provider settles for $425,000 cybersecurity enforcement from NJ state attorney general
- OCR issues guidance on Extreme Risk Protection Orders
- HIPAA Privacy Rule and OCR enforcement changes due to come into effect in 2022
- EHR giant Cerner is acquired by Oracle; implications for healthcare organizations
- NIST launches new international cybersecurity and privacy resources website
- Norton antivirus discovered to be pre-loaded with crypto mining software
Meditology provides cybersecurity, privacy, and risk support for hundreds of healthcare entities across the country. We have been tracking macro trends in threats, risk exposures, regulations, enforcement, and best practices for healthcare cybersecurity and compliance programs.
We have compiled the top cyber risk exposures trends and predictions for 2022 to help you map out your defensive strategy heading into the new year.
Join us for this special episode of The CyberPHIx podcast where we discuss:
- A look back at prior healthcare cybersecurity predictions: did we get it right?
- Trends and predictions for healthcare threat actors, attacks, and methods
- Healthcare-specific vulnerabilities and risk exposures
- Regulatory predictions including HIPAA, OCR enforcement, and emerging federal and state laws
- Legal predictions including cyber liability and class action lawsuits
- Cybersecurity program investments and constraints including automation and talent shortages
Meditology Services hosts the healthcare industry's leading podcast, The CyberPHIx, and has produced over 85 episodes to date. We have had the pleasure and honor of conversing with many of the nation’s leaders in healthcare cybersecurity, privacy, and compliance.
Join us for this main stage event where we hear from over 20 CISOs and cybersecurity rock stars from the nation's premier healthcare organizations on some of the toughest challenges we face as an industry. Listen in as we hear practical guidance and seasoned insights from CISOs in their own words as they guide us through their thought process and lessons learned.
This special CyberPHIx episode features a curated collection of highlights as we hear directly from the following industry leaders:
- HCA Healthcare - Britton Burton, Director of Risk Management
- Molina Healthcare - Mike Wilson, SVP & CISO
- Sentara Healthcare - Dan Bowden, VP and CISO
- Premise Health - Joey Johnson, CISO
- Children's Healthcare of Atlanta - Stoddard Manikin, CISO
- Horizon Blue Cross Blue Shield of NJ - Chris Golden, Director of Information Security
- Children's Mercy Hospital - TJ Mann, CISO
- Healthix - Nick VanDuyne, SVP/CIO
- Solution Health – Andrew Seward, CISO
- CORL Technologies - Devon Wijesinghe, Chief Transformation Officer
- Risk Recon - Kelly White, CEO
- Lehigh University - Eric Zematis, CISO
- Imprivata - Wes Wright, CTO
- Spiritus – Susan Ramonat, CEO
- Health Partners Plans - Mark Eggleston, CISO
- NYC Healthcare - John Jessop, Associate Director of Information Security Programs
- NASCO - Lauret Howard, Chief Risk Officer
- Meditology Services - Nadia Fahim-Koster, Partner & Bethany Page, Director
This session covers the gamut of major cybersecurity and risk trends for healthcare including:
- HIPAA Compliance and Risk Management
- Ransomware & Incident Response
- Third-Party Vendor Risk Management
- Risk Reporting & Engaging with the Business
- Cloud Security Risk Management
- Medical Device & IoT Security
- Security Certification Options in Healthcare (HITRUST, SOC 2, ISO)
Grab your leather jacket and dial your headphones' volume up to ‘11’ - you won’t want to miss the opportunity to listen in to this many security rock stars in a single session.
The CyberPHIx Roundup is your quick source for keeping up with the latest cybersecurity news, trends, and industry-leading practices, specifically for the healthcare industry.
In this episode, our host Brian Selfridgehighlights the following topics trending in healthcare cybersecurity this week:
- FTC Final Rule released: mandatory penetration testing, MFA, vendor risk management, risk assessments, and more implications for healthcare entities
- New report on healthcare IoT security operations from CrowdStrike and Medigate
- CHIME report on the state of cybersecurity for ambulatory and long-term care facilities
- CISA issues a critical cybersecurity alert related to the holiday season
- US warning of Iranian government-sponsored attacks underway leveraging Microsoft and Fortinet vulnerabilities
- HHS issues alert and guidance on uptick of zero-day attacks for healthcare
- 2022 trends in advanced persistent threats from Kaspersky
The CyberPHIx Roundup is your quick source for keeping up with the latest cybersecurity news, trends, and industry-leading practices, specifically for the healthcare industry.
In this episode, our host Brian Selfridge highlights the following topics trending in healthcare cybersecurity this week:
- Details and analysis of the new CISA incident response and vulnerability response playbooks
- Cloud Security Alliance (CSA) and healthcare CISOs publish a detailed medical device security playbook
- Medical device security best practices and program development
- High-risk alert for Siemens medical device vulnerabilities impacting thousands of devices
- Emerging trends on healthcare Application Programming Interface (API) adoption, attacks, and mitigation recommendations
- Ohio hospital diverts ambulances and patients due to ransomware outage
- International partnerships and agreements with the US, EU, France, and Israel are enacted to address cyberattacks and ransomware
- US charges two major ransomware operators in continued takedown of REvil ransomware gang and other international prosecutions of cybercriminals
HITRUST provides a range of cybersecurity and privacy certification and accreditation solutions including their flagship HITRUST CSF certification, which is one of the most widely-adopted security frameworks for healthcare organizations.
The demand for cybersecurity certifications and assurances like HITRUST is at an all-time high due to escalations in breaches at healthcare entities and their vendors in the supply chain. However, not all certifications are created equal, and the industry is outgrowing the one-size-fits-all certification model.
HITRUST has announced new security certification models including the new HITRUST i1 certification. The new HITRUST options are designed to provide more flexibility and speed for HITRUST certifications while reducing the cost and effort to achieve certification.
Join us for this episode of The CyberPHIx as we hear from Michael Parisi, Vice President of Adoption for HITRUST. We discuss hot-off-the-presses details of HITRUST’s new security certification and solutions including:
- Market trends and demand for security certifications for healthcare entities
- The history and evolution of security certifications including the HITRUST CSF (now called HITRUST r2), SOC 2, ISO, and others
- Detailed overview of the new HITRUST i1 certification option
- HITRUST i1 security controls requirements including focus on implementation of controls
- HITRUST i1 certification requirements, timing, level of effort, release schedule, impact to HITRUST CSF (HITRUST r2) certified entities
- Breaking news on changes to the Cybersecurity Maturity Model Certification (CMMC) security certification program
- Details of the HITRUST Basic, Current State Assessment (bC)
- HITRUST privacy certification updates
- Details of HITRUST’s new Results Distribution System (RDS)
The CyberPHIx Roundup is your quick source for keeping up with the latest cybersecurity news, trends, and industry leading practices, specifically for the healthcare industry.
In this episode, our host Brian Selfridgehighlights the following topics trending in healthcare cybersecurity this week:
-
Highlights of 25+ Cyber Breaches to Payers, Providers, & Healthcare Vendors in the Last Two Weeks
- UPMC Hacker Gets 7 Years in Prison
- HITRUST Deploys a New Certification Option
- Google Launches AI Pilot with NJ Healthcare Provider
- Microsoft Launches New Privacy Management Framework for Office365
-
Tips for Managing Remote and Hybrid Security Teams
-
Russians Continue Aggressive Attacks Despite US Sanctions and Intervention
- State Department’s Plans for New Cybersecurity Office
- Ransomware Disclosure Act Bill Introduced with 48-hour Reporting Timeframe
Breaches and ransomware infections are hitting healthcare hard alongside the critical supply chain that helps keep healthcare operations running. The federal government has been issuing a flurry of guidance, executive orders, draft regulations, diplomacy, and more to try to kickstart our national response to the cyber crisis. We are calling in the cavalry, but will it help? In this episode of The CyberPHIx, we hear from Steve Dunkle, Chief Information Security Officer for Geisinger Health System.
Steve is one of the country's leading cybersecurity healthcare leaders and we get his perspective on some of these federal updates and proposed changes to see how they fare in terms of providing meaningful support and guidance for healthcare organizations.
We discuss new federal and standards guidance and related trends including:
* NIST’s “Bad Practices” cybersecurity guide for end-of-life devices, default passwords, and single-factor authentication
- Ransomware guidance from the NSA, FBI, and CISA on stopransomware.gov
- Third-party risk and supply chain risk guidance and pending regulations
-
Strategies for CISO executive success include a focus on customer service, strategic thinking and planning, networking, and continuous learning
- Incident response and cyber-resilience guidance
- OCR enforcement focus areas and HIPAA Security Rule compliance
The CyberPHIx Roundup is your quick source for keeping up with the latest cybersecurity news, trends, and industry-leading practices, specifically for the healthcare industry.
In this episode, our host Brian Selfridge highlights the following topics trending in healthcare cybersecurity this week:
- Key takeaways from The Annual Cybersecurity Attitudes and Behaviors Report 2021
- US Securities and Exchange Commission (SEC) fines for breaches and related news on the focus of third-party risk in stock exchange investments
- Analysis of a new report from RiskRecon and Cyentia on measuring the ongoing impact of multi-party breaches
- Discussion of Mandiant’s detailed report on the FIN12 criminal gang that is actively targeting the healthcare industry
- The latest FBI and CISA alerts on the Conti ransomware attacks and recommendations for protecting healthcare organizations
The CyberPHIx Roundup is your quick source for keeping up with the latest cybersecurity news, trends, and industry leading practices, specifically for the healthcare industry.
In this episode, our host Brian Selfridgehighlights the following topics trending in healthcare cybersecurity this week:
-
OCR’s announcement of new director, Lisa J. Pino
- FTC expands the Healthcare Breach Rule; implications for healthcare entities and enforcement
- Healthcare breach highlights including Apple Healthkit, FitBit, GoogleFit, Walgreens, Fortinet, and more
- Details on “irrecoverable” EHR ransomware event for an Arizona-based healthcare provider
- Summary of new Cloud Security Alliance guidance on ransomware protections
- U.S. Treasury takes action against cryptocurrency in a counter-ransomware initiative
Cyber hurricanes have been coming in fast and furious for healthcare organizations over the last several years. Their destructive force has left organizations with operational disruptions, financial loss, and reputational damage that may take years to clean up.
It is incumbent upon healthcare entities to take advantage of the tame periods between cyber incidents to make investments in preparation and response capabilities.
In this episode of The CyberPHIx, we tap into the extensive emergency management experience of Patrick Hinnant, Director of IT Operations, Facilities, and Emergency Management for Trillium Health Resources.
We discuss approaches for cyber emergency preparedness and several other topics including:
- Incident response and continuity from the ground level staff perspective all the way up to the executive level
- IT help desk and support best practices for incident response
- Common pitfalls and best practices for emergency response programs
- IT-specific challenges and approaches to emergency response including dealing with hybrid and cloud hosted infrastructures
- Grappling with cyber incidents and outages involving third-party vendors in the supply chain
- Evolving models of behavioral health and how to maintain these critical services during the pandemic
- External resources and guidance for cyber emergency management best practices and standards
The CyberPHIx Roundup is your quick source for keeping up with the latest cybersecurity news, trends and industry leading practices, specifically for the healthcare industry.
In this episode, our host Brian Selfridge highlights the following topics trending in healthcare cybersecurity this week:
- Details of 15+ breaches of business associate vendors servicing healthcare organizations that occurred in the last two weeks alone
- Evolving cybercrime business models and the emergence of Initial Access Brokers (IABs)
- Top cybersecurity and IT certifications that drive the highest salaries for security professionals in the industry
- Recent OCR enforcement activity and fines for HIPAA Privacy Rule violations
- Analysis of the cybersecurity “Bad Practices” catalog from the CISA and implications for healthcare entities
The CyberPHIx Roundup is your quick source for keeping up with the latest cybersecurity news, trends and industry leading practices, specifically for the healthcare industry.
In this episode, our host Brian Selfridge highlights the following topics trending in healthcare cybersecurity this week:
- Big tech firms including Google and Apple make major moves to exit the healthcare industry
- Amazon moves full steam ahead into healthcare, but is struggling to scale solutions due to IT and cyber staffing skill set shortages
- Cybersecurity staffing and talent shortage trends and new initiatives from the White House and CISA designed to build the cyber workforce
- Details of $30b+ cybersecurity investment commitments from President Biden’s summit with ADP, IBM, Apple, Google, Microsoft, Amazon, and other big tech firms
- New targeting of healthcare business associates and outpatient practices by cyber criminals
- California breach notification bulletin details from California’s Attorney General and implications for state regulatory enforcement across the country
The CyberPHIx Roundup is your quick source for keeping up with the latest cybersecurity news, trends and industry leading practices, specifically for the healthcare industry.
In this episode, our host Brian Selfridge highlights the following topics trending in healthcare cybersecurity this week:
- Suing the CISO: analysis of a lawsuit against SolarWinds CISO
- Details of Scripps Healthcare’s $113m reported revenue loss due to ransomware
- Cyber liability protection cost increases
- Analysis of a new report citing $47k per hour downtime costs for breaches
- Cyber security highlights from the HIMSS 2021 conference
- Newly updated guidance from NIST on developing cyber resilient systems
- CSO Magazine’s 15 top strategic priorities for CISOs
- Universal decryption key for Kaseya ransomware leaked in hacker forum
- Accenture’s breach of 6 terabytes of data and $50m ransom demand from hackers
New cybersecurity and privacy regulations have recently come into effect in the United Arab Emirates (UAE). These laws are coming at a time when the US, EU, and other countries are poised to introduce new regulations of their own designed to combat the global epidemic of cyber-attacks.
Listen in to this episode of The CyberPHIx as we speak with Mohammed Fadlalla, Co-Founder and Privacy Practice Leader for Archlight, the premier provider of healthcare cybersecurity and privacy consulting services in the UAE, Middle East and North Africa regions.
In this episode, we discuss details of the emerging cybersecurity regulations and risks in the UAE, as well as their impact to healthcare organizations locally and globally.
Highlights of the discussion include:
- Overview of the new UAE cybersecurity and privacy regulations
- Scope and reach of the regulations and enforcement models
- Comparison of UAE regulations to HIPAA requirements
- Details of the healthcare ecosystem in the UAE
- Implications for vendors, payers, and other players operating in the UAE
- Privacy expectations for patients in the UAE and healthcare tourism
- Guidance for getting started with compliance and prioritizing remediation efforts
The CyberPHIx Roundup is your quick source for keeping up with the latest cybersecurity news, trends and industry leading practices, specifically for the healthcare industry.
In this episode, our host Brian Selfridge highlights the following topics trending in healthcare cybersecurity this week:
- Analysis of IBM’s new 2021 Data Breach Report including:
-
- Impacts to healthcare organizations
- Healthcare’s breach costs and benchmarks against other industries
- HIPAA compliance implications for breach costs
- Cloud security breach trends
- Top sources of breaches and highest risk security domains
- Ways to reduce breach costs with targeted investments
- Nine critical vulnerabilities identified for the “Pwned Piper” medical device vulnerability issue and related recommendations
- Details of President Biden’s proposed $9.8b cybersecurity budget
- President Biden’s commentary on the likelihood of cyberwars leading to physical wars
- The new cybersecurity memorandum released by the White House this week
- Trends and predictions for new federal and state cybersecurity regulations targeting healthcare
The CyberPHIx Roundup is your quick source for keeping up with the latest cybersecurity news, trends and industry leading practices, specifically for the healthcare industry.
In this episode, our host Brian Selfridge highlights the following topics trending in healthcare cybersecurity this week:
- The new DHS CIO speaks out on plans for supply chain risk management
- PracticeFirst healthcare vendor breach impacting 1.2 million individuals
- U.S. government launches one-stop shop for ransomware guidance (StopRansomware.gov)
- CISA publishes cybersecurity guidance for managed services providers in the wake of the Kaseya breach
- Former NSA director’s preview of HIMSS21 presentation on ransomware and cyber risks
- China formerly accused by the EU, UK, US, and others of attacks against Microsoft Exchange
- New SolarWinds zero-day exploit being used by attackers (second SolarWinds incident)
- Urgent security warning for SonicWall supply chain solution and patching details
- HITRUST announces the timing for release of HITRUST CSF version 10
- Class action lawsuit updates against a PACs vendor, Kroger pharmacy, and Blackbaud
Another colossal cyber-attack on the global supply chain took place this month, which saw over 1,500 businesses infected with ransomware via a breach of a third-party vendor, Kaseya. The breach comes on the heels of other large-scale supply chain attacks against SolarWinds, Microsoft, and other major third-party vendors.
This brings critical questions to the forefront for our industry: who is accountable for supply chain breaches and who owns the risk?
In this CyberPHIx episode, we attempt to answer these questions during this engaging podcast interview with Eric Zematis, Chief Information Security Officer of Lehigh University.
Eric discusses approaches for managing liability for supply chain attacks including business accountability and communication, cyber liability insurance, third-party vendor obligations, and government intervention.
Highlights of the discussion include:
- Managing and communicating third party risk with the business
- Accountability for the business in oversight and management of vendor risk
- The history and evolution of cyber liability insurance
- Cyber liability policies and coverage considerations
- Supply chain vendor accountability before, during, and after breach events
- Government accountability and roles in combatting supply chain cyber attacks
- Standards organizations and resources for managing supply chain risks
The CyberPHIx Roundup is your quick source for keeping up with the latest cybersecurity news, trends and industry leading practices, specifically for the healthcare industry.
In this episode, our host Brian Selfridge highlights the following topics trending in healthcare cybersecurity this week:
- Largest ransomware attack on record impacts 1,500 businesses via third-party Kaseya supply chain breach over the holiday weekend
- Several large ransomware providers call it quits due to increased scrutiny and pressure
- Ransomware attack on Ireland health system exceeds $600m in costs and remains active six weeks into the attack
- Ukrainian police arrest members of CLOP ransomware gang
- NIST releases draft guidance for Ransomware Risk Management & CISA releases a ransomware self-assessment tool
- President Biden’s summit with Vladimir Putin and directive for a “no hack” list of US critical infrastructure
- DOJ charges network security executive with hacking a Georgia health system for personal gain
- One billion CVS records exposed in cloud configuration error breach
- Details of the Ponemon Institute’s new third-party cloud compromise report
- OIG and FDA updates on medical device security guidance and new GAO cybersecurity recommendations
- Bipartisan data breach notification bill drafted which includes a 24-hour breach notification requirement
- Meditology Services was ranked the #1 healthcare security and privacy consulting firm according to a new survey reported by Becker’s and Healthcare IT Security magazines
“Digital identity is the new control fabric,” says our CyberPHIx guest Wes Wright, CTO at Imprivata. Wes is one of the healthcare industry's most experienced technology leaders and has held prior roles as CTO for Sutter Health in California, CIO for Seattle Children's, Executive Director of Information Services for Scripps, and much more.
The healthcare industry is moving headlong into digital healthcare models that rely on one common factor: Identity Management.
In this episode, Wes shares his thoughts on industry challenges with patient identification and access control models as they relate to our rapid move into a digital healthcare model.
We also discuss trends for processes, standards, and technology to address emerging patient and workforce identity challenges as well as the implications for patient privacy, identity fraud, enterprise security, and much more.
Highlights of the discussion include:
- Patient identification challenges and risk impacts
- 21st Century Cures Act implications for patient identification
- Updates to trends in national patient identification
- HIPAA and regulatory compliance drivers for digital identity management
- Technology and automation advances in identity and access management
- The evolution identity technology and current capabilities
- Identity and access control models for cloud-hosted and third-party solutions
- Practical operational guidance for identity management programs to address emerging digital health models
The CyberPHIx Roundup is your quick source for keeping up with the latest in cybersecurity news, trends and industry leading practices, specifically for the healthcare industry.
In this episode, our host Brian Selfridge highlights the following topics trending in healthcare cybersecurity this week:
- Major shifts in cyber liability coverages and protections and results from a recently released U.S. Government Office of Accountability (GAO) report
- Scripps Health system network outage continues a month after initial cyberattack
- Russian SolarWinds attackers are back at it with a large spear phishing campaign following a compromise of USAID systems
- Security firm Rapid7 becomes a victim of a software supply chain breach targeting source code
- OCR’s latest settlement details and analysis on the resolution agreement with Peachstate Health Management
- OCR and HHS “wall of shame” aggregate reporting trends for 2021 and analysis of major reported breaches this past month
- U.S. House Committee on Homeland Security advances five new bills to improve cyber defenses
The CyberPHIx Roundup is your quick source for keeping up with the latest cybersecurity news, trends and industry leading practices, specifically for the healthcare industry.
In this special episode, our host Brian Selfridge provides a rundown of the presidential executive order, Improving the Nation’s Cybersecurity, signed by President Biden in May. Also covered is the executive order, America's Supply Chains, signed in February of this year.
The executive order is the second and most comprehensive of two executive orders issued by President Biden on cybersecurity topics this year. Brian provides a summary of the orders and discusses implications for healthcare entities.
Analysis is provided for key topics from the executive order including:
- Enabling the sharing of threat intelligence and protection mechanisms
- Modernizing federal government cybersecurity
- Enhancing software supply chain security
- The establishment of a cyber safety review board
- Standardizing the federal government’s playbook for responding to cybersecurity incidents and vulnerabilities
- Improving detection of cybersecurity vulnerabilities and incidents on federal government networks
- Improving the federal government's investigative and remediation capabilities
- National security systems requirements
The CyberPHIx Roundup is your quick source for keeping up with the latest cybersecurity news, trends and industry leading practices, specifically for the healthcare industry.
In this episode, our host Brian Selfridge highlights the following topics trending in healthcare cybersecurity this week:
- National emergency declared for Colonial Pipeline ransomware attack; details and implications for healthcare entities
- Analysis of the Cloud Security Alliance Report titled The State of Cloud Security Concerns, Challenges, and Incidents
- CISA’s new guidance for managing supply chain risks, including lessons learned from a historical review of supply chain attacks for the past decade
- CISA/FBI alert on the “FiveHands” ransomware attackers
- A new GDPR EU directive and pending legislation requiring continuous due diligence of third-party vendors
- NIST soliciting comments for updating their guidance on implementation of the HIPAA Security Rule
Who is responsible for cybersecurity? It’s a simple question, but the answer may be more complex than you think.
Listen in to this episode of The CyberPHIx as we sit down with TJ Mann, Chief Information Security Officer at Children's Mercy Hospital in Kansas City.
TJ helps us understand why it takes a cyber village to protect healthcare organizations. We delve into the roles and responsibilities that various stakeholder groups need to play to support and deliver effective information security programs.
Highlights of the discussion include:
- Which specific roles and stakeholders have the greatest impact on cybersecurity program effectiveness
- Healthcare business units that carry the most risk for healthcare entities
- Managing accountability for third-party vendors and shadow IT groups
- The changing role of enterprise risk management in healthcare
- Busting the myth that there is only one kind of end user
- The tension and collaboration between security, internal audit, and compliance functions
- The impact of the remote workforce on security roles and expectations
- The evolution of security leadership and team roles and functions
The CyberPHIx Roundup is your quick source for keeping up with the latest cybersecurity news, trends and industry leading practices, specifically for the healthcare industry.
In this episode, our host Brian Selfridge highlights the following topics trending in healthcare cybersecurity this week:
- Analysis of Mandiant’s M-Trends 2021 Cyber Attacks and Trends Report and implications for healthcare
- Shifts in threat vectors due to remote work, ransomware focus, and adversary techniques. Teaser: phishing is no longer the top threat vector
- FBI / CISA Alert: Top 5 “favorite” attack methods of the Russian SVR ransomware group targeting healthcare (e.g. Citrix, VMWare, and other specific exploits)
- President Biden’s sanctions and diplomatic pressure on Russia for healthcare cyberattacks
- Breach update: the latest healthcare supply chain breaches and trends with high-risk vendor “categories” like revenue cycle management; CareFirst healthcare payer breach analysis
- $1.5m penalty for the New York DFS cybersecurity regulation and its impact for healthcare entities
- 21st Century Cures Act updates
The CyberPHIx Roundup is your quick source for keeping up with the latest cybersecurity news, trends and industry leading practices, specifically for the healthcare industry.
In this episode, our host Brian Selfridge highlights the following topics trending in healthcare cybersecurity this week:
- President Biden’s executive order on supply chain risk that calls out healthcare specifically
- Analysis of a claims fraud case in Texas with a troubling scope including intentionally hastening patient deaths
- Highlights from a recent study on increased patient awareness and impact over ransomware and telemedicine breaches
- New UN standards for nation state online behavior and implications for enforcement and deterrents for cyberattacks targeting healthcare
- Macro trends on the momentum of cyberattacks, patient awareness, and countermeasures in national and global theaters
Obtaining enterprise cybersecurity certifications can be a daunting task for those embarking on the process for the first time as well as those that are managing repeat certifications.
Some critical questions emerge: Which certification is the best for my organization? How do I limit the cost, time, and requirements to achieve certification? Will obtaining a healthcare certification make us HIPAA compliant? What else do I need to know to get through the certification process?
Join us for this episode of The CyberPHIx podcast where we speak with Bethany Page Ishii, Director at Meditology Services. Bethany leads Meditology’s healthcare cybersecurity certifications and shares her insights in working to successfully certify countless healthcare entities for more than a decade.
Highlights of the discussion include:
- Overview and adoption levels for cybersecurity certifications in healthcare including SOC 2, HITRUST, ISO, and others
- Common pitfalls that can add time and cost to the certification process
- The role of certifications in addressing major breaches and supply chain risks
- The relationship between HIPAA compliance and security certifications
- How to handle security control gaps and still obtain certifications
- Review of security certifications for individuals and recommendations for healthcare professionals
The CyberPHIx Roundup is your quick source for keeping up with the latest cybersecurity news, trends and industry leading practices, specifically for the healthcare industry.
In this episode, our host Brian Selfridge highlights the following topics trending in healthcare cybersecurity this week:
- Microsoft’s Exchange email critical exposure for healthcare entities
- New ransomware report cites $20b in losses for healthcare in 2020 alone; details and analysis are provided
- A major hack of over 150,000 security cameras allows external parties to view ICU rooms and other hospital locations
- HIPAA Privacy Rule comment period extensions
- COVID-19 vaccine registration websites getting hit by malware bots
The CyberPHIx Roundup is your quick source for keeping up with the latest cybersecurity news, trends and industry leading practices, specifically for the healthcare industry.
In this episode, our host Brian Selfridge highlights the following topics trending in healthcare cybersecurity this week:
- UHS announces $67m cost from recent ransomware attack
- OCR HIPAA enforcement rundown for 2021
- Accellion file transfer application supply chain breach and impacts on healthcare
- SolarWinds CEO testimony and analysis on the surprising position taken by the company
- Cyber warfare perspective and predictions for healthcare
What does it mean to be a pragmatic healthcare CISO and how does that differ from pursuing more idealistic, and perhaps unattainable, cybersecurity strategies?
Join us for this episode of The CyberPHIx as we speak with Mitch Parker, CISO at Indiana University Health. We tap into Mitch’s decades of operational security experience to find out what really works when implementing cybersecurity and compliance programs for healthcare entities.
Highlights of the discussion include:
- Differentiating pragmatic vs. idealistic security leaders and programs
- Realistic and achievable thresholds for typical security domains including vulnerability management, medical device security, phishing protections, and more
- How to identify projects that may not yield expected returns on investment
- Customer service-oriented cybersecurity approaches
- Effective techniques for relationship building and stakeholder management
The CyberPHIx Roundup is your quick source for keeping up with the latest cybersecurity news, trends and industry leading practices, specifically for the healthcare industry.
In this episode, our host Brian Selfridge highlights the following topics trending in healthcare cybersecurity this week:
- Overview of a $931m telehealth fraud case and how patient information becomes monetized
- Patient records from two health systems posted to the dark web from an extortion attempt
- Nationwide Children’s research data stolen and sold to China
- A breach at UPMC attributable to a third-party legal vendor; analysis of top breach vendor categories
- Class action lawsuit against third-party vendor U.S. Fertility from ransomware attack in 2020
- FTC settles with a fertility app called Flo for selling patient information & class action against another fertility app for selling data to China
- Water treatment plant hack and related hacking techniques explained that apply to healthcare entities
- Summary of Virginia’s new Consumer Data Protection Act
- FDA appoints a newly created leadership position for medical device security
- Summary of the proposed Public Health Emergency Privacy Act for protecting COVID-19 patient data
The CyberPHIx Roundup is your quick source for keeping up with the latest cybersecurity news, trends and industry leading practices, specifically for the healthcare industry.
In this episode, our host Brian Selfridgehighlights the following topics trending in healthcare cybersecurity this week:
- MD Anderson has a $4.3m OCR fine vacated by appellate court in third appeal; potential impacts to OCR enforcement going forward are explored
- Micky Tripathi and Robinsue Frohboese are tapped to lead ONC and OCR
- President Biden invests $10b in cybersecurity to combat Russian attacks and strengthen US cyber protections
- Excellus Health Plan settles with OCR for a $5.1m penalty
- OCR continues enforcement of HIPAA Right of Access by fining Banner Health in 2021
- A class action lawsuit is waged against Rady Children’s Hospital-San Diego for failure to protect against a ransomware breach caused by their third-party business associate, Blackbaud
A groundbreaking cyberattack against the SolarWinds IT and network solutions provider has resulted in unauthorized access to a wide range of government and private sector organizations.
The extent, scale, and impact of the attack are still being assessed; however, initial indications are that the attack will have lasting security impacts for months and possibly years to come for organizations, including healthcare entities.
In this episode of The CyberPHIx, we speak with Devon Wijesinghe, Chief Transformation Officer at CORL Technologies, a tech-enabled managed services company dedicated to vendor risk management for the healthcare industry. Devon is an acclaimed innovator and leader in the data industry, with extensive experience transforming tech-enabled service organizations into on-demand SaaS platforms to solve big problems, including third-party vendor risk.
Devon discusses the recent SolarWinds supply chain attack and its implications for healthcare organizations and the management of third-party vendor risk more broadly in 2021 and beyond.
Highlights of the discussion include:
- A brief overview of the SolarWinds attack and its impact on healthcare
- Leveraging risk data to improve risk decisions and investments in third-party risk management for healthcare entities
- Comparable vendors to SolarWinds and the potential for other similar attacks to the supply chain going forward
- Trends in attack methods and motives of malicious actors
- Solutions for tackling supply chain risks including technology automation, people, and process
- Common pitfalls for vendor risk management programs
- The future of supply chain risk management in healthcare and innovations underway in the marketplace to scale to address this challenge
The CyberPHIx Roundup is your quick source for keeping up with the latest cybersecurity news, trends and industry leading practices, specifically for the healthcare industry.
In this episode, our host Brian Selfridge highlights the following topics trending in healthcare cybersecurity this week:
- The House passed an amendment to the HITECH Act that provides OCR enforcement safe harbors for adoption of security best practices including NIST and HITRUST
- OCR guidance issued for HIEs and disclosures of PHI to public health authorities during the pandemic
- NSA cybersecurity advisory about cloud attack techniques that are successfully bypassing standard access controls
- A new FBI ransomware advisory for the DopplePaymer ransomware strain
- NSA’s guidance for addressing attacks targeting outdated encryption protocols including SSL and TLS
- NIST released cybersecurity standard for PACS and radiology systems
- The latest updates on the groundbreaking SolarWinds attack and related recommendations for healthcare entities
The CyberPHIx Roundup is your quick source for keeping up with the latest cybersecurity news, trends and industry leading practices, specifically for the healthcare industry.
In this episode, our host Brian Selfridge highlights the following topics trending in healthcare cybersecurity this week:
- A leading U.S. cybersecurity firm FireEye has been reportedly hacked by a nation state; implications for the healthcare industry are explored
- A global phishing campaign is underway targeting the COVID-19 supply chain; we discuss the specific healthcare, pharmaceutical, IT, and other third-party organizations at risk
- OCR issues their final penalty of the year
- Kalispell Health proposes $4.2m legal settlement related to a 2019 hacking attack and breach
- President-elect Biden names the new Secretary of Health and Human Services
Join us for a very special episode of The CyberPHIx, where we take a look back at the major themes in healthcare cyber risk in the wild year that was 2020 - and also look forward toward trends and predictions for 2021 and the next decade of security, privacy, and risk management challenges for healthcare entities.
Listen in as CyberPHIx host Brian Selfridge explores a Top 10 list of healthcare cybersecurity, privacy and risk themes for 2020-2021 while outlining major trends and predictions for our industry heading into the new year.
Highlights of the discussion include:
- Healthcare shifts its focus toward patient safety and operational impacts of cyber events
- Remote is the new normal: security and privacy impacts for adoption of telehealth and telework models
- Class action lawsuits change the playing field for financial impacts related to cyber events
- Breach trends and the escalation of hacking attacks on healthcare entities
- New privacy and security regulations and enforcement are steady despite political and social volatility
- Third-party vendor risk becomes a dominant focus for security programs
- Cloud security emerges as its own specialized security domain
- Enterprise risk reporting becomes the “must have” skill set for security leaders and programs
- Increased automation of security processes and capabilities
- Staffing shortages for cyber talent and the rise of managed security services
The CyberPHIx Roundup is your quick source for keeping up with the latest cybersecurity news, trends and industry leading practices, specifically for the healthcare industry.
In this episode, our host Brian Selfridge highlights the following topics trending in healthcare cybersecurity this week:
- Congress passes the Internet of Things (IoT) Cybersecurity Improvement Act of 2019-2020; impacts to the healthcare industry are discussed
- Analysis of the recently approved cybersecurity exception for the Stark anti-kickback law from HHS
- An overview and review of NIST’s newly released SP 1800-30: Securing Telehealth Remote Patient Monitoring Ecosystem
- Updates from Canada’s proposed Digital Charter Implementation Act (DPIA) of 2020 and what this means for US-based healthcare organizations
The CyberPHIx Roundup is your quick source for keeping up with the latest cybersecurity news, trends and industry leading practices, specifically for the healthcare industry.
In this episode, our host Brian Selfridge highlights the following topics trending in healthcare cybersecurity this week:
- The FBI’s alert for an imminent ransomware attack on the US healthcare system; summary of the evolving attack and protection measures
- The Maze ransomware group calls it quits; details of their related announcement
- Hackers targeting psychotherapy notes for ransom and extortion
- California election results: citizens approve a new California Privacy Rights Act of 2020 (CPRA) which touts the “strongest online privacy rights in the world”. Note: this is different from the California’s related CCPA regulation.
- Aetna hit with a $1m HIPAA fine from OCR related to three separate breaches
- $350,000 class action lawsuit for St. Francis Healthcare related to ransomware attack
The steady drumbeat of ransomware and related breaches and outages in healthcare persists despite our industry’s need to grapple with yet another surge in the global pandemic.
Healthcare CISOs and leaders are also reeling from the recent revelation of a patient death directly attributable to ransomware. Healthcare organizations are moving swiftly to deploy capabilities to predict, detect, contain, and respond to these attacks; and the stakes have never been higher.
Join us as we celebrate 50 episodes of The CyberPHIx in this special interview with Stoddard Manikin. Stoddard is the Director of Information Security for Children's Healthcare of Atlanta (CHOA) and has over 18 years of progressive experience in the information technology, security and privacy field. Highlights of the discussion include:
- Attack trends and escalating impacts to patient safety from ransomware attacks
- Ransomware's evolution and availability as a SaaS solution for malicious actors
- Risks and supply chain impacts to health systems when Business Associates get infected with ransomware
- The U.S. Treasury Department’s Office of Foreign Assets Control (OFAC)'s decision to begin fining healthcare organizations that pay the ransom
- HIPAA implications for ransomware attack response approaches
- Ransomware incident response approaches including during a pandemic with a remote workforce
- Evolving prediction, detection, and prevention strategies
A Message from Brian Selfridge: Celebrating 50 Episodes of The CyberPHIx
I am honored to share this engaging interview with Stoddard Manikin, which we are releasing as our 50th episode of The CyberPHIx. I want to thank our listeners and the amazing guests we've had over the past few years on the show. We appreciate the time that these industry leaders have taken out of their busy schedules to share their insights and knowledge with the community.
We also appreciate your willingness to tune in and stay up to speed on the many challenges and solutions facing health care, security and privacy programs. I have learned a great deal through these sessions, and I hope you have, too. I look forward to sharing many more interviews in the years to come and look forward to working collaboratively with each of you to keep our healthcare organizations and information safe.
The CyberPHIx Roundup is your quick source for keeping up with the latest cybersecurity news, trends and industry leading practices, specifically for the healthcare industry.
In this episode, our host Brian Selfridge highlights the following topics trending in healthcare cybersecurity this week:
- California’s Attorney General imposes a $250k settlement on healthcare app developer, Glow, Inc. for privacy and security violations of the Confidentiality of Medical Information Act (CMIA)
- British Airways GDPR fine of £20m; breach details, correlations to attacks on healthcare, and GDPR ramifications for healthcare organizations
- FDA’s announcement of a new Medical Device Development Tools (MDDT) program that includes a rubric for applying CVSS vulnerability ratings to medical devices
- Russians indicted in 2017 NotPetya ransomware attack
- Rundown of the top 10 healthcare breaches this past month
The CyberPHIx Roundup is your quick source for keeping up with the latest cybersecurity news, trends and industry leading practices, specifically for the healthcare industry.
In this episode, our host Brian Selfridge highlights the following topics trending in healthcare cybersecurity this week:
- Mega fines and legal costs totaling more than $270m related to two breaches for health insurers Premera and Anthem. We break down the details behind the OCR penalties, state fines, and class action lawsuits.
- NIST releases the new NIST SP 800-53 Rev 5, the first overhaul of NIST 800-53 in over seven years. We discuss the major changes to the standard and its implications for healthcare entities.
- The U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) warns that it may begin to issue fines for organizations that facilitate payment to ransomware attackers. We discuss the difficult position healthcare providers face between patient safety and potential federal fines.
- Highlights from the ransomware breach of Universal Health Services this week that may impact its over 400 locations.
The CyberPHIx Roundup is your quick source for keeping up with the latest cybersecurity news, trends and industry leading practices, specifically for the healthcare industry.
In this episode, our host Brian Selfridgehighlights the following topics trending in healthcare cybersecurity:
- A recent patient fatality directly resulting from a cyber attack; details and analysis
- OCR’s latest resolution agreement and $1.5m fine for a Covered Entity breach involving a third-party Business Associate
- A ransomware recovery case study from a hospital that remains crippled for several months following the attack
The atmosphere of healthcare delivery is changing, as critical business functions move to third-party cloud-hosted platforms.
Ascending the business into the cloud, however, does not transfer the risk of breach and regulatory storms - and can even introduce new risks that must be evaluated, tracked, and remedied.
In this episode of The CyberPHIx, we speak with Dan Bowden, VP and CISO for Sentara Healthcare. Dan has decades of healthcare security leadership experience and during this session, discusses ways to identify and prepare for the “dark clouds” looming on the horizon.
Highlights of the discussion include:
- Leveraging critical security controls models for cloud deployments
- Cloud Application Security Broker (CASB) solutions and lessons learned
- Customer accountability in shared controls models for cloud environments
- Third-party risk management, SLAs, and contract management with cloud providers
The CyberPHIx Roundup is your quick source for keeping up with the latest cybersecurity news, trends and industry leading practices, specifically for the healthcare industry.
In this episode, our host Brian Selfridge highlights the following topics trending in healthcare cybersecurity this week:
- Key takeaways and analysis of the Cloud Security Alliance’s new report on Cloud Risk Management, including shared responsibility, third-party risk, new cloud audit & reporting models, and more
- A new amendment to California’s Consumer Privacy Act (CCPA) regulation related to deidentification of patient data
- The outcome of a lawsuit leveled at the Nuance transcription company related to their 2017 ransomware breach that impacted health systems
- Details of the FBI and CISA alert this week for an ongoing voice phishing (vishing) campaign targeting remote workers
- Analysis of a Harvard study released this week highlighting security risks with COVID-19 home monitoring devices
Malicious attacks were the listed as the dominant threat vector and source of healthcare breaches this year according to IBM’s 2020 Data Breach Report [1]. Top sources of compromises from these malicious attacks included compromised access credentials, cloud misconfigurations, and vulnerabilities in third-party software.
Opportunistic cyber attackers have seized the moment of a pandemic to target vulnerable healthcare entities and their remote workforces for their own personal gain. Attacks have leveraged COVID-19 themes for social engineering assaults, phishing campaigns, ransomware entry, and more. Healthcare organizations are on their heels trying to thwart unprecedented viruses, both physical and virtual alike.
In this CyberPHIx episode, we speak with Kevin Sacco, who leads the Ethical Hacking and Penetration Testing practice for Meditology Services. With almost 20 years in the field, Kevin talks about his experiences hacking healthcare organizations, including recent pandemic-era attacks.
Highlights of the discussion include:
- Heartless hackers: the bad guys and their motives
- Common healthcare security vulnerabilities and cybersecurity weak spots identified in penetration testing assessments
- The impact of the pandemic on attack methods, remote workforce targeting, and protection mechanisms
- Recommendations for the most cost-effective and impactful security controls to mitigate attacks
- War stories from decades of hacking healthcare entities
The average breach costs healthcare organizations $7.13m. Organizations that conduct routine penetration testing save an average of $243k per breach.
Healthcare is likely to remain in the cross hairs of attackers for some years to come. Kevin provides practical and cost-effective recommendations for thwarting these damaging attacks on our critical healthcare infrastructure.
The CyberPHIx Roundup is your quick source for keeping up with the latest cybersecurity news, trends and industry leading practices, specifically for the healthcare industry.
In this episode, our host Brian Selfridge highlights the following topics trending in healthcare cybersecurity this week:
- A curious malware ‘Meow bot’ identified an unsecured healthcare database exposed to the Internet and replaced over 3.1 million patient records with the word “meow”
- NIST’s new Zero Trust Architecture framework released this week; application of the framework and implications for healthcare entities
- Apple’s deployment of new privacy “nutrition labels” required for apps in iOS 14
- FTC announces a ramp up in privacy enforcement at PrivacyCon 2020 conference this week; what this means for healthcare entities
The CyberPHIx Roundup is your quick source for keeping up with the latest cybersecurity news, trends and industry leading practices, specifically for the healthcare industry.
In this episode, our host Brian Selfridge highlights the following topics trending in healthcare cybersecurity this week:
- Review of the key healthcare cybersecurity findings in the 2020 IBM Cost of a Data Breach Report (formerly known as the Ponemon Data Breach Report)
- Average healthcare breach costs, top sources of data breaches, and most effective security interventions for reducing breach costs and impact
- Analysis and recommendations for healthcare security CISOs and programs to adjust based on this new data and related trends
- Details of a presidential executive order issued this week to promote rural telehealth access and incentives for Medicare populations
- $53m federal stimulus proposed to improve cybersecurity and protect COVID-19 research data
The CyberPHIx Roundup is your quick source for keeping up with the latest cybersecurity news, trends and industry leading practices, specifically for the healthcare industry.
In this episode, our host Brian Selfridge highlights the following topics trending in healthcare cybersecurity this week:
- Telehealth adoption trends and highlights from a new KLAS report released this week
- Lessons learned from a recently reported breach event for a telehealth app
- Federal HIPAA and state exemption extensions and modifications related to telehealth platforms and recommendations for steps that healthcare providers can take to secure telehealth platforms
- 21st Century Cures Act enforcement, fines, and technical integration and security mandates
- Smart phone app integration standards for EHRs as part of the Cures Act including HL7’s FHIR standard, EHR and app development progress, and related security requirements and recommendations for healthcare entities
Cybersecurity incidents have wide-ranging impacts including patient safety, operational effectiveness, and regulatory compliance. Effective preparation and response to common security incidents have become an essential organization skill set required to survive the tumultuous environment facing healthcare entities today.
Join us in this episode of the CyberPHIx where we speak with Nadia Fahim-Koster, who is a Partner with Meditology Services and leads the organization’s privacy and security practice. We discuss cybersecurity incident response trends and leading practices for healthcare entities.
Highlights of the discussion include:
- How to engage the business: incident response simulations techniques and approaches
- Lessons learned from incident response tabletops and real-world cybersecurity events
- Changes to incident response practices during COVID-19
- The dependence on third parties and incorporating third-party communication and planning into incident response plans
- How to engage external parties like the FBI and cyber liability providers in incident response processes
- Ransomware payment trends and decision points for the business
The CyberPHIx Roundup is your quick source for keeping up with the latest cybersecurity news, trends and industry leading practices, specifically for the healthcare industry.
In this episode, our host Brian Selfridge highlights the following topics trending in healthcare cybersecurity this week:
- UnityPoint Health in Iowa reaches a $2.8m class action lawsuit related to phishing breaches in 2018; discussion on implications for the industry, breach response lessons learned, OCR and class action risks, and recommended actions for healthcare entities
- NIST report released looking at the statistical trends for financial losses related to cybercrime activity; analysis of the report and implications for healthcare security program investments
- UCSF pays $1.14m ransom to retrieve COVID-19 research data; details of the case, FBI involvement and negotiations; recommendations provided for ransomware prevention and response
- Bipartisan Senate introduction of an amendment to the 2021 National Defense Authorization Act that would provide funding for a cybersecurity coordinator in every state, and re-instate the national cybersecurity director position that the Trump administration eliminated
The CyberPHIx Roundup is your quick source for keeping up with the latest cybersecurity news, trends and industry leading practices, specifically for the healthcare industry.
In this episode, our host Brian Selfridge highlights the following topics trending in healthcare cybersecurity this week:
- Arrest of a hacker charged with UPMC health system hack in 2014; discussion of attacker motives, methods of sale of healthcare data, and “bad guy business drivers” in healthcare
- Medical device and IoT alerts from Homeland Security including six prominent manufacturers vulnerabilities and the “Ripple20” vulnerabilities affecting millions of IoT and IoMT devices
- Healthcare organization adaptations to the “new normal”; an analysis of post-COVID business models and technologies that are causing security and risk teams to adjust their approaches. Trends covered include communication with remote workforce, collaboration tools, telehealth technology, incident response, and more
The CyberPHIx Roundup is your quick source for keeping up with the latest cybersecurity news, trends and industry leading practices, specifically for the healthcare industry.
In this episode, our host Brian Selfridge highlights the following topics trending in healthcare cybersecurity this week:
- Cloud-based attacks are ramping up; details on specific attacks and alerts for Office365, AWS, Azure, telehealth, and the impacts to compliance, clinical operations, and patient safety
- Recent leading practices for healthcare cloud security protections including inventories, cloud assessments and pen tests, third party risk oversight, cloud strategy plans, and more
- New Washington DC breach law impacting any organizations with resident data; reporting requirements, identity protection mandates, and third-party contractual requirements
- Medical device, telehealth, and other large-scale procurement during COVID that requires security assessment and oversight
- Latest attack trends for ransomware data auctions, phishing attacks targeting VPNs, and more
Security and risk teams have been overwhelmed by the tsunami of requests for vendor security risk assessments as the digital health movement continues to shift data to third-party platforms.
Constraints on human capital and time have never been tighter. Leading organizations are looking for ways to focus their teams on true risk management activities rather than perpetually collecting and formatting risk data.
Information security and risk leaders have turned to services, technology and automation to help keep pace with this unprecedented demand for third-party security assessments. However, the volume and variety of solutions hitting the market has some heads spinning trying to make sense of it all.
In this episode of The CyberPHIx, we speak with Siobhan Hunter, Vice President of Strategic Solutions for CORL Technologies. CORL provides tech-enabled managed services for third-party vendor security risk management for healthcare entities.
Highlights of the discussion include:
- Pros and cons of solutions available on the market include GRC platforms, cyber risk scoring, survey automation, third-party risk exchanges, and tech-enabled managed services
- Characteristics of third-party risk program maturity ranging from low-maturity to industry-leading programs
- How to strike the right balance of people, process, and technology to extract value and reduce cost for vendor security programs
- Lessons learned from leading third-party security risk programs inside and outside of healthcare
The CyberPHIx Roundup is your quick source for keeping up with the latest cybersecurity news, trends and industry leading practices, specifically for the healthcare industry.
In this episode, CyberPHIx host Brian Selfridge highlights the following topics trending in healthcare cybersecurity this week:
- Identity and access management risk exposures and security exceptions specific to COVID-19 shifts in remote access, furloughed employees, and more
- Remote access and RDP attack trends and mitigation
- Federal security advisories on foreign attacks against US-based healthcare research entities for SARS-CoV-2 and COVID-19
- Two new privacy bills introduced in Congress related to COVID-19 contact tracing apps
Managing security risk at the enterprise level has become increasingly difficult as digital health information becomes pervasive, both inside and outside healthcare delivery settings.
That challenge is even more pronounced for very large providers operating hundreds of hospitals, outpatient facilities, research centers, and administrative support functions.
In this episode, CyberPHIx host Brian Selfridge speaks with Britton Burton, Director of Risk Management, Information Protection & Security for HCA Healthcare, the largest health system in the United States.
Learn more about strategies for managing security risk at scale, including risk information capture and communication to support meaningful decision making for the business. Highlights of the discussion include:
- Identifying assets and commonly overlooked areas where sensitive information may reside
- Gathering and communicating meaningful risk information
- Prioritizing assessment and remediation activities across a broad portfolio of systems and locations
- Engaging with the business and building meaningful relationships across geographies and functions
- Approaches for driving efficiencies for large-scale risk management programs
- Managing and demonstrating regulatory compliance at scale
The CyberPHIx Roundup is your quick source for keeping up with the latest cybersecurity news, trends and industry leading practices, specifically for the healthcare industry.
In this episode, our host Brian Selfridge highlights the following topics trending in healthcare cybersecurity this week:
- Privacy, security, and HIPAA considerations for COVID-19 patient tracing and tracking apps from Google, Apple, and Microsoft
- Discussion of “immunity passports” and privacy repercussions
- Attack and breach trends for healthcare entities including themes for phishing, malware, and ransomware and foreign government malicious activity
- Office 365, Zoom, and Webex attacks and security configuration recommendations for remote access “rushed deployments”
Healthcare cybersecurity, risk, and compliance personnel in healthcare settings have historically been required to work predominantly onsite. COVID-19 has opened the floodgates to remote work options for a variety of personnel in healthcare settings including the cyber workforce.
The changing landscape and acceptance of remote work may help to alleviate the cybersecurity talent shortages that many healthcare organizations have faced over the past several years.
Join us in this episode of The CyberPHIx as we speak with Mark Odom, Vice President & CISO at Thomas Jefferson University Hospitals & Jefferson University to discuss strategies for hiring and operating a remote workforce, as well as several other strategic considerations for healthcare security programs.
Highlights of the discussion include:
- Remote workforce strategies for security teams pre- and post-Corona
- Philosophies for HIPAA vs. risk management emphasis for healthcare security programs
- Effective executive communication strategies for security leaders
- Approaches for improving efficiency and quality for security programs
- Optimizing deployment of automation and managed services to support healthcare security programs
The CyberPHIx Roundup is your quick source for keeping up with the latest cybersecurity news, trends and industry leading practices, specifically for the healthcare industry.
In this episode, our host Brian Selfridge highlights the following topics trending in healthcare cybersecurity this week:
-
HIPAA exceptions for COVID-19 for telehealth, first responders, patient consent, NPPs, and more
-
Zoom videoconferencing security updates and recommendations
- Maintaining continuity for the Information Security program in a crisis including implications for risk assessments, compliance, managed services, team management, incident response, security certifications, and more
The CyberPHIx Roundup is your quick source for keeping up with the latest cybersecurity news, trends and industry leading practices, specifically for the healthcare industry.
In this special edition episode, our host Brian Selfridge discusses updates and recommendations for healthcare security and IT teams to manage the COVID-19 / Coronavirus pandemic response. Content covered includes:
- News updates for cancelled conferences including HIMSS and HCCA and changes to security assessment models from HITRUST and other firms
- Trends in cyber attacks leveraging the COVID-19 notoriety
- Recommendations for healthcare security teams for remote work security and rollout models, awareness training, telehealth models, BC/DR plans, and more
The complexity of managing physical and virtual assets in increasingly digital healthcare environments creates a dauting task for security professionals. Fortunately, some promising technologies and standards are beginning to emerge to help evolve capabilities for identifying, tracking, and securing healthcare assets across the enterprise.
In this episode with Susan Ramonat, CEO of Spiritus, we discuss trends in asset management standards development, distributed ledger technology, medical device tracking, regulatory activity, and more.
Highlights of the discussion include:
- The future of healthcare asset management including service models, unique identifiers (UDI), RFID, geolocation services, and predictive analytics
- Lessons learned from Scotland's deployment of distributed ledger technology in the healthcare provider setting
- Software Bill of Materials (SBoM) standards from the FDA and other groups like National Telecommunication and Information Administration (NTIA)
- Using distributed ledger to help with infection control from asset movement for outbreaks like the coronavirus
- Software and data asset management approaches
- The role of IoT and IoMT technology solutions
- People, process, and governance considerations for healthcare asset management programs
- Responding to industry-wide medical device vulnerabilities like Urgent 11
- Proposed federal investments for the FDA for medical device security
The CyberPHIx Roundup is your quick source for keeping up with the latest cybersecurity news, trends and industry leading practices, specifically for the healthcare industry.
In this episode, our host Brian Selfridge highlights the following topics trending in healthcare cybersecurity this week:
-
Recent third-party vendor ransomware events impacting healthcare providers
-
Insider threats and cases of unauthorized access to patient information and related criminal charges; discussion of approaches for monitoring for insider threats
- Major themes from the last year of OCR fines and settlements and projections for the rest of this year for OCR enforcement
The CyberPHIx Roundup is your quick source for keeping up with the latest cybersecurity news, trends and industry leading practices, specifically for the healthcare industry.
In this episode, our host Brian Selfridgehighlights the following topics trending in healthcare cybersecurity this week:
- Law firms under fire: 5 law firms hit with ransomware and Legal Services ranked in top 10 most vulnerable vendors servicing healthcare entities
- HHS Office for Civil Rights makes changes to individuals’ right of access to health records following lawsuit from Ciox – implications for privacy and security programs are discussed
- Interoperability rules from HHS and CMS, Epic’s pushback on privacy, pros and cons of the new Interoperability requirements for security and privacy
The CyberPHIx Roundup is your quick source for keeping up with the latest cybersecurity news, trends and industry leading practices, specifically for the healthcare industry.
In this episode, our host Brian Selfridge highlights the following topics trending in healthcare security this week:
- The New NIST Privacy framework released in January 2020
- OCR fine for Texas Health and Human Services ($1.6m)
- A breach reported by The University of North Carolina (UNC) at Chapel Hill School of Medicine
- New research that correlates cybersecurity events to adverse patient safety outcomes
The move to digital healthcare is advancing innovative uses for health information that also introduce unforeseen risks to patient privacy. Federal and state regulations are playing catchup to stem the tide of privacy breaches and harm to patients as information disseminates across disparate healthcare systems and platforms.
In this episode of The CyberPHIX, Meditology ITRM Partner Brian Selfridge sits down with First Health Advisory CEO Carter Groome to discuss trends in privacy controls, regulations, third-party privacy risks, and more.
Highlights of the discussion include:
- New federal interoperability rules that are promoting the “unleashing of data” for care, treatment, and research
- Congressional activities and proposed privacy bills
- State privacy regulations including California’s CCPA regulation, Utah’s privacy regulations, and more state movement on privacy requirements
- Third-party privacy risks and audit models
- Google and Amazon’s movement into the healthcare arenas and privacy impacts for large scale healthcare data sets
About First Health Advisory CEO Carter Groome
Carter’s organization focuses on organizational assets and data and building risk management programs for government and commercial healthcare delivery organizations. Carter's leadership background includes roles in Provider, HIT product, and management consulting organizations. Also as an AEHIS Board Member, Carter is active in public policy, congressional activities and health specific privacy and security legislation that may impact providers and consumers alike.
The CyberPHIx Roundup is your quick source for keeping up with the latest cybersecurity news, trends, and industry leading practices specifically for the healthcare industry.
In this episode, our host Brian Selfridge highlights the following topics trending in healthcare security this week:
- Regulatory enforcement activity from OCR for Sentara Hospitals ($2.2m fine)
- Class action lawsuit and 10-day downtime for the ransomware infection of DCH Health in Alabama
- Asset management approaches for IoT and IoMT trending in CISO discussions heading into 2020
The vision for 2020 healthcare security is clouded with security threats, compliance and enforcement activity, and rapidly evolving business models and regulatory landscapes. However, we can also see many opportunities on the horizon this year and beyond to improve the industry’s protections of healthcare organizations and patient information.
Join us for a special edition of The CyberPHIx as we take a look at the major trends in healthcare cybersecurity, privacy, and compliance heading into the new 2020 calendar year.
Topics discussed include:
- Cybersecurity’s movement away from IT-focused issues and into enterprise risk management
- Breach trends and business impacts
- New ransomware attacks and protection mechanisms
- Regulatory and enforcement activity from OCR, GDPR, California, New York, and more
- Third party vendor security and privacy risk management
- Asset management, IoT, and Medical Device Security
- Hacking and attack trends
- Cybersecurity talent shortages
- Capital and operating budget trends
- Big privacy and big data issues
- Mergers, acquisitions, and affiliations
Healthcare has historically lagged behind other industries in the adoption of emerging cybersecurity protections. Innovative blockchain technology has the potential to shift that trend as more healthcare entities have started to explore a variety of use cases for applying blockchain technology. Does blockchain have a future in healthcare or are we caught up in another hype cycle for emerging cyber technologies?
In this podcast, industry thought leader Chris Golden helps us take a closer look at blockchain and its potential applications in healthcare. Chris is the Director of Information Security for Horizon Blue Cross Blue Shield of New Jersey and shares his insights on blockchain, enterprise risk management, and governance risk and compliance approaches.
Topics discussed include:
- Defining blockchain and an overview of its capabilities both within and outside healthcare
- Use cases for blockchain in healthcare including back office, financial systems, patient identification, and more
- Adoption timeline for blockchain in healthcare
- What could go wrong? Downsides and potential pitfalls for blockchain and managing PHI/PII on the ledger
- Enterprise risk management approaches including quantitative vs qualitative risk data
- Governance risk and compliance tools, processes, and automation best practices
In the latest Verizon Data Breach Investigations Report, 39% of data breaches were linked to organized crime. We take a close look at the tactics of these cyber “bad guys” in our latest podcast with 25-year industry veteran and cybersecurity superhero, Brian Dykstra.
Brian is the President & CEO of Atlantic Data Forensics and has an extensive career thwarting cybercriminals in his current role as well his prior background serving as the co-founder and CIO of Mandiant.
Brian Dykstra joins Meditology Partner and CyberPHIx host Brian Selfridge to discuss what the “bad guys” in cybersecurity are doing and how your organization can prepare and respond to their attacks. This podcast features the following topics:
- Cybercriminal activities targeting healthcare entities are compared and contrasted with other industry verticals.
- Examples of highly sophisticated email fraud approaches favored by savvy cybercriminals are described in detail along with prevention and detection approaches.
- They are using our superpowers against us: the rise of attacks that leverage innovative intrusion and theft methods from “Red-Team” penetration testing tools.
- Ransomware attack trends and defensive approaches.
- Network maturity models and security controls approaches for bolstering defenses against cyberthieves.
- Suggestions for fundamental protection, detection, and response practices that have been time tested to protect organizations from cybercriminals.
Managing shifting priorities is difficult in most environments but presents unique challenges to healthcare security risk and privacy professionals. In this podcast, leading security executive John Jessop shares techniques for managing security project demands for both planned and unplanned initiatives.
Meditology Services Partner Brian Selfridge leads the discussion with John Jessop, Associate Director for Information Security Programs and External Information Security Affairs for a large-not-for-profit organization headquartered in New York City.
Topics discussed include:
- Managing the balance between planned work and operational realities of incident response, lack of internal resources or changing priorities
- Segregating work between strategic, operational or “fire drill” response
- Handling conflicting priorities or key stakeholders within the organization that are not available
Just as the great pyramids began with a solid base that supports the central apex, information security teams rely on the base levels to solidify the entire team structure. Recruiting and training professionals at entry and mid-levels are keys to building a solid info security infrastructure that can meet security threats and demands in the future.
Recruiting and training a competent and diverse information security team for healthcare organizations is the topic of this Podcast featuring Dr. Pablo Molina, AVP and CISO at Drexel University and Brian Selfridge, ITRM Partner at Meditology Services. This informative podcast addresses the following topics:
- The top skills in demand for information security professionals within healthcare
- A close look at the value of bachelor's/master's degree programs, certifications, job-training and mentoring in training cybersecurity workers specifically for healthcare settings
- Approaches and advantages of working with transitioning workers with non-traditional education and work backgrounds into healthcare information security
- Tips to bring together information security professionals and the academic community to better mentor and communicate training needs
Moving mountains is a symbolic reference to changing an organization’s priorities and conditions. Changing a workforce and management mindset to focus on security may seem like moving mountains, as well. This CyberPHIx podcast examines one veteran healthcare compliance officer’s experience in changing the organizational culture to integrate security and compliance with the core business.
In this podcast, Lauret Howard, the former Chief Risk Officer for NASCO and now CEO of Watchtower Consulting speaks with Brian Selfridge, Partner of Meditology Services about the following topics:
- Shifting business priorities to include information security as a top-level issue
- Synchronizing security, privacy and compliance functions, roles and responsibilities
- Evolution of cybersecurity as a business function and a defined role within healthcare organizations
- Establishing accountability for cybersecurity, physical security and information security, at all levels
- Establishment audit processes and certifications to evaluate security efficacy and progress
- Pitfalls and sure-fire ways to kill a security or privacy program
The digitization of healthcare delivery is upon us. One estimate of medical IoT adoption, estimates that 87% of healthcare organizations will have adopted IoT by the end of 2019. (Forbes, March 2019).
Information security management strategies to cope with the widespread use of medical devices and medical Internet of Things (IoT) technologies are the focus of this CyberPHIx podcast. Mike Wilson, SVP and Global CISO of Molina Healthcare and Brian Selfridge, Partner of Meditology Services, discuss medical devices, IoT and the evolving information security management role.
Highlighted topics include:
-
Medical Device Risk Management and IoT:
- Inventory management
- IoT Tools landscape (existing and emerging tools)
- Prioritizing security among devices; determining which type of devices to address first
- Skill sets needed to effectively manage medical devices and IoT technology
- The role of the medial device manufacturers and the FDA in security leadership
-
The future of the healthcare CISO role in a digital age:
- What does the healthcare look like in 2020-2030 and how is the CISO role evolving?
- Why is healthcare so challenging from a security perspective relative to other industries?
- What trends do we see emerging in healthcare security regulations at the federal, state, and international levels?
Email is the most frequently reported initial point of compromise. In a recent HIMSS study, 59 percent reported that Email Phishing was the initial point of data compromise for all organizations surveyed, and 69 percent of incidents at hospitals.
Dan Reither, a 25-year data security veteran, leads our Podcast exploring email security strategies ranging from technical solutions, data loss prevention, and widespread education of your workforce to social engineering threats. As a strong believer in “deputizing” the workforce and vendor network on email security threats, notification and handling; Dan provides valuable insight to healthcare security managers. Dan is the Manager of Information Security for Health Partners Plans and Vice President of the ISC2 Philadelphia chapter.
Dan and Brian Selfridge, Partner with Meditology Services discuss email security trends and best practices including:
- A look at the evolution of email-attacks from basic phishing to more sophisticated social engineering campaigns. As email security has gotten stronger, there is a shift from taking advantage of technical inefficiencies to more targeted, social engineering.
- A discussion of best practices for securing email platforms and incident response approaches to reduce damage email attacks.
- An evaluation of security protections and technical solutions to handle spam, AV, DLP, and phishing and their effectiveness in different scenarios. A primary technical email security foundation is a gateway and a phishing solution.
- Acknowledgement of the success that malicious actors are having with email-based attacks. Be sure you talk to your vendors and employees underscoring the importance of identifying and properly handling suspicious email activity. All employees across the organization should be “deputized” as security team members and viewed as the front line in detecting and handling email attacks.
Health Information Exchanges (HIEs) play a critical role in improving the continuity of patient care across healthcare entities and geographies. HIEs often operate behind the scenes to coordinate the secure sharing of information across healthcare entities.
Organizations considering using or interfacing with a Health Information Exchange (HIE) will benefit by listening to this Podcast discussion about security and privacy trends with Nick VanDuyne, Executive Director at NY Care Information Gateway and Meditology’s Brian Selfridge.
As the manager of a regional health information gateway partnered with the state of New York, Nick gives us an insider view of risk management security issues and approaches including:
- Key questions to ask in evaluating HIE or Regional Health Information Organizations (RHIOs). Specifically, how to evaluate the security and privacy controls of the entity.
-
Challenges faced by the “big data” aspect of an HIE or RHIO and security approaches to address them. As well as methods for reconciling the security and privacy expectations of a wide range of disparate stakeholders that share and use health data (hospitals, state agencies, and others).
-
The use of security certifications in providing demonstrable assurance of security controls to your members and business partners.
-
An insider view of the inherent security strengths or vulnerabilities of healthcare data communication protocols like HL7, DICOM and newer HIE-specific protocols such as DIRECT.
- Opinions about emerging technologies and security considerations for the next wave of innovations poised to hit the healthcare market.
Join us for this very special CyberPHIx podcast panel of elite healthcare leaders sharing insights on how to build a team of security rock stars. These seasoned CISOs share their approaches to address two major issues facing healthcare risk management programs: 1) Dealing with a severe worker shortage and 2) Defining the role of automation in their long-term management plans.
Panelists: John Abella, IT Security and Enterprise Architecture at Main Line Health, Chuck Goff, Cyber Security Program Manager at Dartmouth Hitchcock Medical Center and Andrew Seward, CISO at Elliot Health Systems
Our CISO panel discussion explores the following strategies for building the best InfoSec programs:
-
The use of job design and workplace policies to attract and retain valuable talent to work in Information Security functions. Many healthcare organizations often must attract talent away from big cities to smaller communities and smaller organizations. Designing jobs that provide intellectual challenge and personal growth opportunities can help. Also, establishing policies and programs that promote teleworking, flex time and other quality of life benefits helps in competing for workers in a limited labor pool; and don’t forget to add some humor into the mix!
-
The view that automation is very helpful and not a displacement of InfoSec jobs. There are already too few workers to fill the demand for information security positions. Rather than replacing jobs, automation helps organizations reduce repetitive, labor-intensive tasks and frees employees to spend their work time on the most valuable and impactful projects. The ROI for automation can usually be found within a few years.
- The downsides to implementing security automation are often in the long-range timeline expectations in healthcare settings. Implementation of security automation in healthcare can be affected by other organizational priorities, buy-in required from other stakeholder departments and developing the internal knowledge to best manage the automation tool.
- It is imperative to understand the key characteristics of successful Security personnel to make the best hiring decisions. Look for people not just with super-specialized areas of technical expertise. Instead recruit on the core job skills of communication, ability to learn new tools, desire to take pride in their work, good coaching and teaching skills, passion for the mission and the ability to have fun in the process.
Hear directly from a forward-thinking physician on how information security and compliance impacts the patient care setting. We sat down with Dr. Geoffrey Mills for a conversation on the intersection of security policies and controls with patient care. Dr. Mills is a Family Medicine physician at Jefferson Health, a large integrated academic medical center in Philadelphia. He is also an Associate Professor at Jefferson and serves as the assistant residency program director in addition to engaging in primary care research.
In this episode, Dr. Mills and CyperPHIx host Brian Selfridge explore data security within the clinical setting including these issues:
- Striking a balance between optimizing information systems, security data and patient care
- Exploring the challenge of providing patient privacy while supporting continuity of care
- Capabilities and perspectives of the next generation of physicians on the role of data security, compliance in clinical service delivery
Learn what physicians and other clinicians think about data security and compliance in this in this informative discussion.
Leadership can be a lonely role. It helps to hear from others in the C-Security suite to share perspectives and validate information security trends in healthcare settings.
This podcast features, Doug Copley, a 25-year veteran in healthcare security, having served as the Chief Information Security Officer for several healthcare entities including large academic medical centers, health information exchanges, and other healthcare entities. As thought leader on cybersecurity and healthcare IT security, Doug’s leadership includes notable roles such as founding the Michigan Healthcare Cybersecurity Council.
In this CyberPHIx episode, Doug shares insights on a range of senior-level topics related to building and managing successful information security programs including the following:
- Building a healthcare security program from the ground up
- The role and key skills of a C-level security executive in 2019 and beyond
- Emerging technologies including blockchain, AI and other emerging technologies
Passion for security, getting to the heart of an issue and cutting through the “IT fluff” are the topics of our latest podcast with Joey Johnson, CISO of Premise Health. Premise Health is a leading provider of direct 24/7 healthcare access services; offering more than 600 health and wellness centers in 44 states to many employers including many Fortune 1000 companies.
Joey and host Brian Selfridge (Meditology Services) have a candid conversation about emerging trends in data security. This Podcast features discussions about the following topics:
- Passion on the job as the most important job skill for data security
- Strategies for dealing with IT staffing shortages
- How to call B.S. on the latest, greatest trending technology requisition
- Methods for effectively evaluating and prioritizing new security technologies, applications and services being introduced into the healthcare market
- Navigating emerging data Privacy requirements both at the state and International levels.
Show Notes:
0:24 Introduction
1:56 Shortage in Staffing Skills
3:07 Talent vs Skills
4:45 Sources of talent
6:12 Skill sets that help drive great hires
8:42 Are soft skills still important
11:45 Are academics able to produce great talent
14:20 Security Automation: What do your tackle first
17:10 You can only implement everything
19:35 What takes priority Policy or Procedures
21:42 Determine what Tech is right for you
24:35 Vendor creep versus consolidation
27:42 Is security getting backed into the process
30:34 Regulation: keep were the data goes safe
32:45 Enforcement is becoming harder due to complexity of data structure
33:51 Is current regulation getting things right
36:39 Where does regulation need to improve
39:29 What happens next with GDPR
41:20 How to incorporate GDPR in current process
44:16 What are your predictions for the Security Industry
47:40 Key takeaways
You can outsource your systems and services, but you cannot outsource your risk.
In 2008, the FDIC set a benchmark for vendor data risk by stating that a financial institution’s BOD and officers are responsible for third-party actions as it affects data security. In healthcare, these same standards are starting to be applied, leading to increased oversight of vendor relationships.
In this CyberPHIx podcast, Kelly White, Founder and CEO of RiskRecon, outlines some key concepts for effective vendor risk management drawing on experience in healthcare as well as other industries very vulnerable to third-party data security breaches.
Kelly’s position in the security automation market, provides us with insight into emerging trends of innovation and technology to better assess risk and potential impact of vendor data sharing. Our discussion with Kelly touches on some of the following trends:
- Understanding vendor risk management in peer industries, such as financial services, reveals opportunities for innovation and more effective oversight over vendor relationships in the healthcare sector.
- The Value of Risk is a key risk management concept that supersedes the rating of risk by the size of vendors. In risk management activities with small or medium-sized vendors, focusing the lens on the Value of the Risk will help set priorities that are most effective in leading to remediation.
- Healthcare is an industry primed to adopt and lead innovation and automation in risk management. The next wave of rapid security automation/innovation is likely to come out of the healthcare industry.
Show Notes
- 0:27 Introduction
- 1:25 About RiskRecon
- 1:55 Practices and solutions in cyber risk management that can be applied to healthcare
- 3:18 Motives for implementing a third-party cyber risk management program
- 4:56 Specific regulations or standards outside of healthcare that are applicable to the industry
- 8:07 HIPAA Compliance | What would you change?
- 10:20 Small to mid-size vendors
- 14:22 Vendors who may pose the most risk
- 17:41 Vendor resources | Does size matter?
- 21:42 The evolution of vendor security risk management
- 28:53 The future of Artificial Intelligence Applications
- 33:35 Key Takeaways
- 36:32 Closing
The FBI reported last year that the average dwell time for hackers in the healthcare environment is 270 days before they are detected. Identifying and dealing with potential security gaps is especially important during security due diligence of new entities.
Learn ways that security time gap can be closed in our recent CyberPHIx podcast episode with Peter Merrill, Director of Information Security at Dartmouth/Hitchcock Health Care System and Meditology’s Brian Selfridge.
Our discussion with Peter touches on the following topics regarding security due diligence of merged and affiliated entities:
- Maintaining good security measures is a good business practice whether or not your organization is acquiring or integrating a new entity.
- Learn which security projects to prioritize when affiliating and integrating a new entity.
- Create a security program that balances the organization’s culture and preference for techniques used in ethical hacking and other security due diligence methods.
- How to deal with different security approaches within affiliated entities.
Show Notes
- 0:29 Introduction
- 1:56 Statistics on how long a hacking attack goes undetected within a healthcare environment
- 3:11 Tactics to view what is happening within the network
- 3:55 GDPR and how to add to the mix
- 5:09 How to communicate risk to business owners
- 8:27 What are the first things that need to be completed during a Merger or Acquisition
- 11:55 Which systems and process win out in a Merger or Acquisition
- 13:30 Reconciling cultural difference15:40 Key Learnings
- 16:07 Introduction to next episode
Our second CyberPHIx podcast interview with Mark Eggleston, CISO of Health Partner Plans centers on communicating strategically with board-level and senior management executives. Mark and Meditology Services partner, Brian Selfridge discuss how to present data security initiatives and issues to senior management.
Show Notes;
- 0:24 Introduction
- 1:04 Governance and Communication
- 3:01 Crisis versus daily preparations
- 4:38 Pull approach to communication rather than Push
- 5:45 Do threats over shadow the common defenses
- 7:54 Framing Technical details to Executives
- 11:04 How do you engage the technical stake holders
- 14:45 How is the role of Security Leader going to change in future
Cloud-based services offer new functionality and efficiency for healthcare organizations, but also bring with them new security considerations for protecting PHI. In this CyberPHIx podcast, Mark Eggleston, VP and Chief Information Security and Privacy Officer of Health Partner Plans discusses implementation strategies for cloud-based applications. Mark and Meditology Services partner, Brian Selfridge discuss the following approaches for managing data security risk within cloud-based applications:
- Identify a business case for securing data in the cloud-environment. Determine if your organization has the experience to implement the cloud-solution internally or might benefit from a third-party with experience in implementing a specific cloud-solution.
- Ensure that Service Level Agreements (SLAs) and Managed Service Agreements (MSAs) with Cloud-Provider include specific security requirements that include scenarios for end-of-service, ongoing risk assessment and downstream data sharing with 4th-party vendors.
- Clearly define user access roles to ensure cloud providers are aligning with the minimum necessary requirements.
- Prepare to educate board-level and senior management about the gaps in security controls with the cloud-providers. Providing a concise, risk management strategy will bolster the security function’s role within the organization.
Handling thousands of security audit questions per month while also conducting routine internal audits is a daunting and tiring task. Audit fatigue is real! However, meeting security audit requests has become a standard for doing business in the healthcare industry. This CyberPHIx episode examines successful approaches to handling security audits from a vendor’s perspective. Hear from Chris Risley, Executive Director Enterprise Risk Management of NASCO, an exclusive provider of claims processing and other services to Blue Cross / Blue Shield Plans across the country. This discussion addresses some of the following questions:
- How do you help your organization to combat audit fatigue?
- What standards do you have in place to improve responsiveness and drive efficiencies in the audit process?
- How do you handle capacity constraints in managing a portfolio of audits with limited bandwidth and staff?
- How does effective security risk management correlate to business value and how is that value communicated to leadership and the marketplace?
Show Notes:
- 1:04 Intro
- 2:11 Increase volume for various audit plans
- 3:07 Organizing to respond to audits
- 5:39 What are the common frame works for audit questions
- 7:41 Can you be proactive in response to eliminate fatigue
- 10:35 How far should organization go with being transparent
- 12:49 Are more resources going to be needed for responding to audits
- 15:33 How to prioritize internal risk management
- 18:03 How flexible does your internal audit plan need to be
- 19:49 What are the common pitfalls for creating a plan
- 23:45 How to combat audit fatigue
- 26:25 How to communicate risk to leadership
- 33:12 Use of analogies to help communicate
- 36:16 How to manage the organization change within the business
- 42:05 Key Findings
- 42:54 Introduction for next podcast
Security framework certifications such as HITRUST and SOC 2 take center stage in this episode of CyberPHIx. Hear from Derek Vorpahl, VP and CISO at Davis Vision, a provider of managed vision care plans nationally. Derek and Meditology Services partner, Brian Selfridge have a candid conversation about where certifications really fit into the overall spectrum of information security risk management tools for healthcare organizations. Our discussion with Derek addresses some of the following issues:
- How well do security certifications reduce the number of security audit inquiries?
- Can security certification requirements be useful in managing day-to-day information security risk management?
- Derek offers advice for people in the early stages of the certification process.
- A broad range of staffing skills are needed to complete the certification process.
Show Notes:
- 2:15 Security Certifications is on the rise and why
- 6:28 Does Certifications reduce the number of audits
- 8:06 Do Certifications help create security program
- 10:45 Things to understand as you start out getting Certifications
- 13:22 What skills that your security teams need
- 17:52 How to get people excited about security audits
- 22:47 Is security sharing of value to your program
- 26:05 Do you recommend the investment in sharing resources
- 27:20 Preparing for an OCR Audit or regulatory threats
- 29:56 How is mergers change a security program build out
- 34:18 How do maintain a team when a merger happens
- 37:19 Key learnings
- 38:16 Introduction to next episode
Developing a cohesive system for meeting HIPAA compliance standards and the never-ending emergence of new security threats can be overwhelming. Approaches to effective compliance management are addressed in this short interview with Bob Quandt, owner of Bullseye Compliance, an experienced healthcare information security officer and leader that has held roles with ShareCare, HCA and several other health entities. The discussion focuses on common challenges faced to by Chief Information Security and Compliance Officers including the security frameworks that work best in healthcare; risk registers and risk tracking approaches; and the importance of obtaining buy-in across departments and varying management levels for new solutions and processes.
Show notes
- Introduction
- 2:02 Governance Risk and Compliance: emerging risks
- 2:41 How to prioritize risks
- 4:15 Balancing risks of the day with daily activities
- 6:29 What standard works best in the market place
- 8:10 Can automation help with operational process
- 10:15 Communicating risks from “C” level to operational workers
- 13:40 Pitfalls within takingly Governance , Risk and Compliance
- 16:09 Key take-aways for episode
In this podcast, healthcare system CISO, Keith Henkell, shares his approach to key data security activities including Privileged Access Management, OCR Audit Reponse and Security Metrics Tracking techniques. Specific discussions center on strategies to reduce privilege-related breaches from occurring such as the use of multifactor authentication and reduction of local admin accounts. Also, Keith provides tips for using security metrics to craft a story for upper management including maturity score of your overall program, coverage indicators from existing security tools and a risk register.
Show Notes
- Introduction
- 1:26 How to prevent privilege- related breaches
- 2:50 Change in culture around Multi-factor
- 4:19 Free/ Cheap Tools
- 5:36 Emerging Password Trends vs NIST
- 7:56 What about privileged accounts?
- 9:10 People need to remember so many passwords / changes… How to remember? Tools?
- 11:35 Other solutions for additional protections? Worth it price-wise?
- 14:08 Local admin accounts? Weaker links in the chain… how to tackle this issue?
- 17:11 Discussion of admin account usage reports
- 17:50 Metrics around AV policies… any evolved philosophies about what to track?
- 22:44 What are the top 3 things to put in front of the board or c-level?
- 24:36 Maturity score is dangerous, shows maybe you're "done" does that mean no more investment?
- 27:49 Metrics to avoid communicating to decision makers?
- 01 Are there any process-oriented metrics to report?
Mergers, acquisitions and divestiture have become widespread among health firms. These events have a major impact on day-to-day privacy and data security programs. In this podcast, two veteran data security and privacy experts from Tivity Health (formerly Healthways), help security teams prepare for these events by sharing first-hand experiences on maintaining and migrating data privacy and data security programs following a divestiture and reorganization. Listen now to hear as Tivity Health’s Jana Courmier, VP of Privacy, Compliance & Accreditation and Paul Wolf, Information Security Officer outline topics such as: maintaining security controls and processes, managing personnel and reduction in staff and communicating effectively with clients.
Show Notes:
- Introduction
- 1:45 Consolidation in the Industry
- 2:45 Challenges with changes in business structures
- 3:35 Migration from ‘what was’ to ‘what is’
- 4:10 Keeping teams in place during big moves
- 6:04 Learning to do more with existing teams
- 8:40 Communication through transition
- 11:20 In-flight projects: How to prioritize during transitions
- 13:40 Benefits of change
- 16:50 Keeping morale up
- 19:55 Preparation is key to successful transitions
- 23:21 Key take-aways for episode
- 24:20 Next episode introduction
A key component of a successful data security strategy is centered on people; specifically navigating and managing cultural expectations and the organization’s philosophy on data management. Expert health system CISO, Nick Falcone, shares first-hand experiences in establishing a formal risk management program with anecdotes and strategies on working within the organization’s culture.
Show Notes:
- 1:40 Strategic Planning
- 3:00 Organizational Goals around people
- 4:00 Project Frameworks to use in Risk Management
- 6:50 Making Security understandable for C-Level
- 9:15 Communicating to the team: What to do vs. How to do
- 12:30 Pitfall Metrics to Start a Program
- 14:45 Maturity views with Metrics
- 17:00 Diversify Risk with Groups
- 19:00 Compliance vs. Risk Management
- 21:00 On-task Strategy vs. Crisis of the Day
- 22:50 Key take-aways for episode
- 23:30 Next episode introduction